Embed Notice

@dequbed @soatok Unless you're just using IPsec as a tunnel encapsulating layer, the reason it's "the wrong layer" is that applications have to know about it to use it, but they can only use it if they're on a system & network configuration that supports it. This is stupid, because applications don't want encryption at the network layer, they want it at the transport layer and possibly also application layer.

If you are just using it to encapsulate a tunnel, it's a less compatible, more stateful, more painful to setup version of wireguard.

Ultimately, encryption at the network layer is not something that benefits application privacy/security. It's just a way to bypass draconian firewalls and metadata harvesting.