alt Hacker NewsI think you are missing the point. It isn't about increasing the bits of security, it's about avoiding the flood of port scanners and the logs that produces.
IPsec is way more complicated to set up than this (or other VPN solutions like Wireguard or OpenVPN for that matter), and doesn't even completely solve that problem, because your ipsec port is open. Although, admittedly, there are probably less bots looking for ipsec than ssh.
Replies
tptacek • today at 6:13 AM
Just stop logging that stuff.
If you enable IPsec, the IPsec protocol becomes open, but there is absolutely no difference in comparison with the configuration proposed in TFA, because any IPsec packet that will be received, but which will fail authentication, will be dropped without any other action, i.e. without any reply, so a remote system cannot determine whether IPsec is open or not.
Like for any other packets, you can choose to log such failures, or not. In the parent article the logs are simplified not by the decision of using special authentication packets for opening the SSH port, but by the decision to not log these packets, which is a completely independent decision.
What a remote system could try to determine is not whether IPsec is open, but whether it is possible to initiate a key exchange for IPsec keys. You can easily run IPsec without using a key exchange protocol, by using pre-shared keys. I am not sure whether the last official version of IKE (Internet Key Exchange protocol) provides any reply packet to an initial connection packet that was not authenticated, but in any case it would be easy to customize the key exchange protocol, to not provide any reply.
While TLS is the necessary solution for the communication between computers that have different owners, for the communication between computers that are owned by the same entity IPsec would have been the correct solution (e.g. for connecting your laptop with your home server when you are away), except that the original variant of IPsec had too many completely unnecessary complications, which deterred potential users. Later it was simplified, but it had already acquired a bad reputation of being too difficult to use.
Today the main problem with IPsec remains that there are many stupid firewalls that block without good reasons most protocols and ports. So one may have to run IPsec over some UDP port, instead of running it as an alternative protocol. If even UDP is blocked, one may have to run IPsec over some TCP port, or just over the http or https port (just masquerading it as TCP, not actually running it over TCP, which would mess with flow control).