In IP tunneling, Device A on Network 1 addresses a message to Device B on Network 2 using the BACnet network layer protocol. It sends the message to the Annex H router on its local network. (The router is called an "Annex H" router because Annex H is the place in the standard where this process is defined.) The Annex H router knows how to send IP messages over the Internet (or an "Intranet" based on IP) to its peer device on Network 2. It encapsulates the BACnet message (in a User Datagram Protocol frame) and sends it via IP to the Annex H router on Network 2. Note that both networks are connected via a standard IP router to the Internet at large.
When the Annex H router on Network 2 receives the IP message from its peer, it removes the encapsulated BACnet message and sends it on to its final destination, Device B.
The only downside to this is that each message shows up twice on each network - once as a pure BACnet message and once as an IP message.