VPN Throughput Calculator

Effective VPN Throughput is the aggregate ceiling set by the link and the firewall's CPU, both of which are fixed regardless of how many tunnels share that capacity. Concurrent VPN Tunnels only changes how that same fixed total gets divided -- Per-Tunnel Bandwidth falls as you add more tunnels, but the aggregate Effective VPN Throughput itself stays the same because this calculator assumes tunnels share one pool rather than each getting an independent allocation.

This calculator computes Link-Limited Throughput from Link Bandwidth and the VPN Protocol's packet overhead, and CPU-Limited Throughput from Firewall VPN Rating and that protocol's processing-cost factor, then reports whichever is smaller as the actual bottleneck. A slower link than the firewall can handle shows "Link"; an underpowered or under-rated firewall relative to the link shows "CPU" -- changing either Link Bandwidth or Firewall VPN Rating can flip which one is binding.

Effective MTU is Interface MTU minus that protocol's per-packet overhead -- the bytes consumed by encryption headers, initialization vectors, and authentication tags before any of your actual data fits in the packet. IPsec AES-256-GCM's overhead (73 bytes) is larger than WireGuard's (60 bytes) in this calculator's figures, so the same 1500-byte Interface MTU leaves less room for payload under IPsec than under WireGuard.

At the calculator's default values, Link Bandwidth moves Effective VPN Throughput by roughly 50% more than Firewall VPN Rating does, with Interface MTU's effect noticeably smaller than either. That ordering isn't a full-range guarantee, though -- because Effective VPN Throughput is the smaller of a link-side and a CPU-side ceiling, whichever side is currently binding is the one that matters, and at the high end of both ranges (fast link, fast firewall) Link Bandwidth and Firewall VPN Rating can move the result by nearly identical amounts. Once one side saturates the other, further increases to the saturated side stop moving Effective VPN Throughput at all.

Yes, within the model here -- a larger MTU spreads each protocol's fixed per-packet overhead over more payload bytes, so Effective MTU and the payload share of each packet both rise as Interface MTU rises. The effect flattens at very large MTUs (overhead becomes a tiny fraction of a huge packet either way), and this calculator does not check whether your actual network path supports the MTU you enter without fragmentation.