Building on that idea further, he can use OpenVPN or one of the virtual appliances that provide those features out of the box, with only a little configuration. I would further recommend, if he's an experienced UNIX user, that he ditch Linux and use OpenBSD. It's built with security as a top priority, with most features secure out of the box, and has features like BCrypt password hashing that make it quite resilient. I often use it for firewalls, vpn, etc. If you don't want the complexity of something like SELinux, but want something that will last on the front lines, an OpenBSD VPN solution is an attractive option. (main downside: hardware support, but all UNIX's have that problem)