First off, this is a purely hypothetical, academic question. It's not intended for a real implementation. It should be clear that, for practical reasons, this is just overkill.

Let's assume I don't trust my own LAN peers, because there is a network hub (not switch) and anyone can listen to my ethernet frames, or because there is a rogue network admin that might be trying to mirror my ethernet port, or because I fear WPA KRACK.

Is it possible to set up IPSec in such a way that traffic between a host and a router is encrypted? That is, a host will encrypt traffic before sending it to a router, which the router will then decrypt and forward regularly to whatever internet host it should route to.

I know traffic can be encrypted between two routers to form a site-to-site VPN, or between two hosts, or between a host and a remote site. But in all these cases, there is a specific target IP address or router where the IPSec configuration can be targeted to.

When routing traffic over a default gateway, the router's IP plays no part: it's the remote host's address that's used, with the gateway's MAC address. So I don't understand if it's possible to set up IPSec in this way.

I know it is possible, however, to do it in another way: use a /30 for each client and treat your connection as a typical "road warrior" to a virtual LAN address space in the router's routing table, and set up IPSec to use the /30 IPs for IPSec endpoints. Or probably use PPTP, L2TP or even PPPoE with layer-2 encryption.

What I want to know if it's possible to have a typical /24 where hosts can maybe use Opportunistic Encryption to talk to each other, but also have the default gateway traffic encrypted.

closed as off-topic by Tim Brigham, MadHatter, yagmoth555, womble Oct 19 '17 at 5:05

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.


Often, VPN connections use "split tunnelling" ie. only a specific subnet (or several) are routed through the tunnel.

Without split tunnelling, all your traffic is routed through the tunnel and all traffic is encrypted - the default gateway is set to the far side of tunnel. Your VPN gateway is likely to be a router, obviously you'll need to be allowed Internet access through it.

VPN is also a common method to increase wi-fi security and solves the WPA2 weakness just discovered.

Not the answer you're looking for? Browse other questions tagged or ask your own question.