You're just trading sshd bugs for VPN bugs, in that case. Which are more likely? From what I know, I think I'll put my lot in with sshd. Perhaps I'm not well informed, though.
Also, sshd + fwknop (port knocking) is a very secure combo, IMO.
Also, sshd + fwknop (port knocking) is a very secure combo, IMO.
openssh always responds (unless I've missed a recent feature) thus exposing which port its listening on and that you sent a bad key.
The silent failure is preferable for this application.
Port knocking gives you a roughly equivalent layer.
Not to mention: nobody's going to be brute-forcing properly generated keys remotely. And if they're not properly generated, you have much bigger problems.
Like the GP said - you're trading VPN bugs for SSH bugs - and experience shows that betting on SSH is generally wiser.
If you only need TCP/DNS and not a full-blown VPN, a program called sshuttle uses ssh+python to provide excellent seamless poor man's VPN. It's not perfect - e.g., you lose the ip src address on the forwarded connections - but it works amazingly well, much better than e.g. openvpn and most other vpn products I've used.
And you're also manually creating SSH tunnels to do anything else inside that network, so you've got that going for you, too.
It's 2015. A VPN is the settled method for accessing sensitive services inside a private network. Doing otherwise may create great nerd cred but doesn't make you do your job better.