I'm using IPSec for my homelab/roadwarrior setup, and that's explicitly because Linux, macOS, and iOS can all use it right out of the box without any "apps" to

I'm using IPSec for my homelab/roadwarrior setup, and that's explicitly because Linux, macOS, and iOS can all use it right out of the box without any "apps" to install. The only gripe I have is that StrongSwan is not a particularly easy piece of software to set up and debug when your tunnels suddenly go pear-shaped. I'd say they are a textbook example on how to screw things up when introducing a whole new set of daemons and configuration format, while a multi-year body of knowledge and corner cases exists only for the old format.