IPsec VPN Setup with Fortigate

I have a freshly installed Debian VPS ready to become the exit point for all traffic coming from my home network. On-prem I’m running a Fortigate 60E that will have to be fully configured to handle the On-prem network (network diagram will be provided) and a fully functional, policy-based IPsec tunnel between the two sites will have to be built so every packet from home leaves the house through the VPS. You may choose either StrongSwan or Libreswan—whichever you work fastest and safest with. Please start with securing the Debian box: configure a strict iptables firewall, deploy an intrusion-detection solution (Fail2Ban, Suricata or similar), and apply the usual hardening steps (SSH tweaks, unattended-upgrades, kernel sysctl tightening, etc.). The VPS must also run its own authoritative nameservers. They should only answer queries arriving through the tunnel, so nothing leaks to the public internet. I’ll rely on you for the full DNS setup, including zone files, recursive forwarders if needed, and any BIND/Unbound tweaks to keep it locked down. Deliverables I expect: • Working Fortigate 60E configuration (CLI or backup file) that establishes an always-on IPsec tunnel to the Debian VPS. • Complete documentation of the Debian covering StrongSwan/Libreswan installation, firewall rules, steps made in hardening • DNS service configuration and records, verified to be reachable only across the VPN. • A brief validation guide showing how to confirm that all home-site internet traffic is being routed through the VPS and that DNS resolution works exclusively over the tunnel. I’ll provide root access to the VPS and read-write admin rights on the Fortigate via VPN or screen-share. Let me know your preferred timeline and any additional information you need before we begin.