Way too complicated!

Here's how to do it with IPsec: Just run this script once after boot, on each machine:

#!/bin/sh
action="$1"
IP1=10.8.0.1
IP2=10.8.0.2
PASSKEY="1234567890123456" ## replace with something more secure
SK="/usr/sbin/setkey -c"

echo -n "Clearing ipsec configuration.. "
$SK <<-EOF
flush;
spdflush;
EOF
echo

[ "$action" = "stop" ] && exit

echo "Enabling ipsec.. "
$SK <<-EOF
add $IP1 $IP2 ah 15700 -A hmac-md5 "$PASSKEY";
add $IP2 $IP1 ah 15701 -A hmac-md5 "$PASSKEY";
spdadd $IP1 $IP2 any -P out ipsec ah/transport//require;
spdadd $IP2 $IP1 any -P out ipsec ah/transport//require;
spdadd $IP1 $IP2 any -P in ipsec ah/transport//require;
spdadd $IP2 $IP1 any -P in ipsec ah/transport//require;
EOF

Now the two machines can communcate securely, using just their regular exposed IP addresses. Appropriate firewall rules are still required to block the rest of the universe.

An improved variation on this, would be to replace [EDIT:] "ah/transport" with "esp/transport" on the above lines.. I didn't have an example of that handy here.