PostgreSQL 10 - secure remote logical replication (SSH?)
For native SSL support:

On the subscription side, you can put sslmode=verify-full in the CONNECTION string for your CREATE SUBSCRIPTION, to force ssl to be used.

On the publication side, you can whitelist only the PostgreSQL port and only for the known IP address of the subscriber at the firewall.  There shouldn't be a need for fail2ban if you do this.  You can also demand that the subscriber side use ssl client cert authentication rather than password authentication, by using cert for the pg_hba method.

Of course you will need a CA to issue certificates, or run your own mini-CA.