I've been looking at WireGuard on and off but so far I'm sticking with IPSec. I currently have two use cases: 1) A road-warrior setup for iOS and MacOS device

I've been looking at WireGuard on and off but so far I'm sticking with IPSec. I currently have two use cases: 1) A road-warrior setup for iOS and MacOS devices with connect-on-demand if needed. Authentication is done using user certificates issued by an internal CA. This gives me secure access to check my security cameras, etc, and makes it completely frictionless. 2) A persistent tunnel to a cloud provider's network. The cloud provider only supports IPSec, so WireGuard isn't even an option here. This is mainly just homelab-type playing around, not serious work. I think WireGuard can do the first use case, but without centralized control over what routes, split tunnels, DNS, IP address assignments, etc, are pushed to the clients. I'd have to manage deploying all of this to the clients by hand instead of letting StrongSwan do it for me. On the IPSec side, setting everything up was a huge amount of effort. My first use case probably took a total of a day and a half (over the course of a couple of years as the solution changed and evolved) to get it into its current state. I'm not including getting the PKI stuff figured out since I wanted that for other stuff anyway. The second use case took me about three days to get set up satisfactorily. Most of this is because I can't see the logs on the cloud provider side, so debugging it is a matter of waiting, sometimes for six hours, for the tunnel to stop passing traffic, followed by tweaking settings based on what the error might be, and repeating. IPSec's complexity[0] really works against it here. I expect that WireGuard would be significantly easier for this use case if the cloud provider supported it. [0] https://wiki.strongswan.org/projects/strongswan/wiki/ConnSection https://wiki.strongswan.org/projects/strongswan/wiki/ConnSec... - I've been staring at this page way too much lately.