Two sites need confidentiality and integrity for traffic crossing an untrusted carrier. Which approach is appropriate?

1. A higher routing metric on the carrier
2. An authenticated encrypted site-to-site tunnel
3. A separate DNS zone for each site
4. Private IP addresses without cryptographic protection