Why won't Apple let us secure our VPNs?

I love my iOS devices.  THey just work.  I know that "work" means a subset of what's possible, as defined by Apple, but I'm over that.  (And I have other devices to let me do wireless scanning, change my kernels, etc.)

A pet peeve of mine is how I can't change the default ports in the PPTP VPN client settings.  Let me tell you a story.

Up until a couple of years ago I ran an SSH service on port 22, the default.  Because I saw a lot of failed attempts at logging in my attackers, I ran an automatic blacklisting tool.  If five failed attempts com in from the same IP in five minutes, the IP is added to a blacklist (hosts.deny).  It's also shared with other users of the script.  Not two hours would go by, 24/7 where some IP didn't get added to the list.

Then I decided to move SSH to a non-standard high port.  Over the next two years I watched it closely, to determine the impact of changing from the default.  Guess how many failed attempts I saw on the high port?

None.  Not one.  In two years.

It seems attackers aren't bothering with actual port scanning, at least on wholesale ISP connections.

Which brings me back to iOS.  I'm running PPTP services on a standard port.  (Yes, I know it's been broken, but it also turns out there's no built-on iOS support for OpenVPN.  Something for another article.)

The iOS client does not let you set the connection port.  This is typically done by adding the port to the hostname, such as "host:12345", but that's not honored either.

So as a result, to support iOS clients I have to keep PPTP at the standard port, and rely on my blacklisting tools.

Apple, please add this capability.  We need all the help we can get.