IPSec tunnel mode

Tunnel mode
Encapsulates the entire packet
New destination IP address (the VPN peer) is set for the packet
VPN peer decapsulates/etc packet and routes original data as appropriate