We have take the approach that the only ports visible to internet traffic are un-authenticated ones... everything else must traverse ipsec or wireguard. This gi

We have take the approach that the only ports visible to internet traffic are un-authenticated ones... everything else must traverse ipsec or wireguard. This gives us completely silent ssh ports. We found strongswan examples pretty useful... it's basically pick your config and copy/paste. Wireguard only has 'one way' to set it up which is a whole 'nother level of simplicity. This has completely silenced our firewall and ssh logs. Nobody is out blasting ipsec or wireguard connection probes around the internet (for now).