First off, this is a purely hypothetical, academic question. It's not intended for a real implementation. It should be clear that, for practical reasons, this is just overkill.
Let's assume I don't trust my own LAN peers, because there is a network hub (not switch) and anyone can listen to my ethernet frames, or because there is a rogue network admin that might be trying to mirror my ethernet port, or because I fear WPA KRACK.
Is it possible to set up IPSec in such a way that traffic between a host and a router is encrypted? That is, a host will encrypt traffic before sending it to a router, which the router will then decrypt and forward regularly to whatever internet host it should route to.
I know traffic can be encrypted between two routers to form a site-to-site VPN, or between two hosts, or between a host and a remote site. But in all these cases, there is a specific target IP address or router where the IPSec configuration can be targeted to.
When routing traffic over a default gateway, the router's IP plays no part: it's the remote host's address that's used, with the gateway's MAC address. So I don't understand if it's possible to set up IPSec in this way.
I know it is possible, however, to do it in another way: use a /30 for each client and treat your connection as a typical "road warrior" to a virtual LAN address space in the router's routing table, and set up IPSec to use the /30 IPs for IPSec endpoints. Or probably use PPTP, L2TP or even PPPoE with layer-2 encryption.
What I want to know if it's possible to have a typical /24 where hosts can maybe use Opportunistic Encryption to talk to each other, but also have the default gateway traffic encrypted.