Am trying to understand how IPSEC in tunnel mode achieves the VPN functionality. I understand that the IP header and payload along with TCP/UDP headers are encrypted. But, if the src and dst addresses of the outer un-encrypted IP header is same as the IP addresses (SRC and DST) in the inner original encrypted IP header, then anyone who sniffs the packet will know which two end-points are communicating.
so, my question is what are the IP addresses used in outer un-encrypted IP HDR in a typical implementation? Is there any guide-lines specified in the RFC ?