Having worked on IPsec many years ago, I became convinced it could never be fully secure due to its sheer complexity, either intentionally (hi, NSA!) or merely due to design-by-committee. Just don’t use it, please. SSH tunnels or openVPN are preferable.