OCI VPN Calculator
Size OCI Site-to-Site VPN tunnels for a throughput target and price the egress, since the VPN service itself is free.
Inputs
Each IPSec tunnel supports roughly 250 Mbps.
Oracle charges nothing for the Site-to-Site VPN service — raise this only to model a third-party appliance.
Tunnels Required
3
IPSec Connections Required
2
Monthly Cost
$0.00
VPN Service Charge
$0.00
Egress Charge
$0.00
Billable Egress
0GB
Throughput Headroom
25.0%
Design Verdict
Active-active: 3 tunnels carry the load with one spare for a failure
Step by step
Values used
Throughput required = 400 Mbps; Throughput per tunnel = 250 Mbps; Redundancy design = Active-active (both tunnels carry traffic); Price per IPSec connection-hour = 0 USD/hour; Billed hours per month = 744 hours; Outbound traffic over the VPN = 3 TB/month; Free egress allowance = 10 TB/month; Egress price per GB above the allowance = 0.0085 USD/GB
OCI VPN
tunnels = ceil(required Mbps ÷ per-tunnel Mbps), plus one spare for active-active or doubled for active-passive; connections = ceil(tunnels ÷ 2) because each IPSec connection provides two tunnels.
Tunnels Required
= 3
IPSec Connections Required
= 2
Monthly Cost
= 0.00
VPN Service Charge
= 0.00
Egress Charge
= 0.00
Billable Egress
= 0 GB
How it works
IPSec throughput is bounded per tunnel, so meeting a target means running several tunnels in parallel and adding capacity for the one that will eventually fail. Oracle provisions two tunnels per Site-to-Site VPN connection and charges nothing for the service, which leaves outbound data transfer above the free 10 TB as the only OCI line on the bill. A single tunnel silently caps a migration or replication stream at a few hundred Mbps no matter how fast the internet circuit is, and an active-passive design needs twice the tunnels for the same usable throughput. Above a few hundred Mbps sustained, FastConnect is usually the better answer — confirm data transfer prices in the Oracle Cloud cost estimator for your region.
Formula
OCI VPN
tunnels = ceil(required Mbps ÷ per-tunnel Mbps), plus one spare for active-active or doubled for active-passive; connections = ceil(tunnels ÷ 2) because each IPSec connection provides two tunnels.
- per-tunnel Mbps
- Practical ceiling of a single IPSec tunnel, about 250 Mbps
- connections
- Each Site-to-Site VPN connection terminates two tunnels
- billable egress
- Outbound GB above the free 10 TB monthly allowance
Frequently Asked Questions
How is OCI VPN calculated?
tunnels = ceil(required Mbps ÷ per-tunnel Mbps), plus one spare for active-active or doubled for active-passive; connections = ceil(tunnels ÷ 2) because each IPSec connection provides two tunnels. IPSec throughput is bounded per tunnel, so meeting a target means running several tunnels in parallel and adding capacity for the one that will eventually fail. Oracle provisions two tunnels per Site-to-Site VPN connection and charges nothing for the service, which leaves outbound data transfer above the free 10 TB as the only OCI line on the bill.
Why does OCI VPN matter?
A single tunnel silently caps a migration or replication stream at a few hundred Mbps no matter how fast the internet circuit is, and an active-passive design needs twice the tunnels for the same usable throughput. Above a few hundred Mbps sustained, FastConnect is usually the better answer — confirm data transfer prices in the Oracle Cloud cost estimator for your region.
What values do I need to enter?
This calculator takes 8 inputs: Throughput required, Throughput per tunnel, Redundancy design, Price per IPSec connection-hour, Billed hours per month, Outbound traffic over the VPN, Free egress allowance, Egress price per GB above the allowance. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.