OpenVPN Performance Calculator
Estimate OpenVPN tunnel throughput and MTU from cipher choice, transport protocol and instance count.
About OpenVPN Performance Calculator
OpenVPN's data channel is single-threaded, so one process is capped by cipher speed no matter how many cores exist; scaling comes from running several instances behind a load balancer. The wire cost is 69 bytes over UDP and 89 over TCP once the extra TCP header and length prefix are counted. It explains the classic complaint that a 1 Gbps circuit only delivers 300 Mbps over OpenVPN, and shows whether the fix is AES-NI, GCM or more daemons.
Formula
OpenVPN Performance
throughput = min(link rate × payload ÷ (payload + overhead), cipher rate × instances), with overhead 69 B for UDP and 89 B for TCP.
- cipher rate
- Data-channel throughput one OpenVPN process sustains on this CPU
- instances
- Independent daemons or --multihome workers sharing the load
Worked example
With the default values below, OpenVPN Performance Calculator returns Expected Throughput of 949.6. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Link rateaccepts 1–100,000 Mbps
- 1,000 Mbps
- Cipher and CPU supportone of AES-256-GCM with AES-NI (520 Mbps/instance), AES-256-CBC + SHA1 with AES-NI (330), ChaCha20-Poly1305 (260), AES-256-CBC without AES-NI (95)
- AES-256-GCM with AES-NI (520 Mbps/instance)
- Transport and overheadone of UDP tun mode (69 B), TCP tun mode (89 B)
- UDP tun mode (69 B)
- Average packet sizeaccepts 64–9,000 bytes
- 1,300 bytes
- Path MTUaccepts 576–9,216 bytes
- 1,500 bytes
- Parallel OpenVPN instancesaccepts 1–64 instances
- 2 instances
Results
- Expected Throughput
- 949.6 Mbps
- Cipher Ceiling
- 1,040.0 Mbps
- Tunnel MTU
- 1,431 bytes
- Protocol Overhead
- 5.04%
- Bottleneck
- Circuit bandwidth
Step by step
- 1Values used
- 2OpenVPN Performance
- 3Expected Throughput= 949.6 Mbps
- 4Cipher Ceiling= 1,040.0 Mbps
- 5Tunnel MTU= 1,431 bytes
- 6Protocol Overhead= 5.04
- 7Bottleneck= Circuit bandwidth
Assumptions and limits
- The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is OpenVPN Performance calculated?
throughput = min(link rate × payload ÷ (payload + overhead), cipher rate × instances), with overhead 69 B for UDP and 89 B for TCP. OpenVPN's data channel is single-threaded, so one process is capped by cipher speed no matter how many cores exist; scaling comes from running several instances behind a load balancer. The wire cost is 69 bytes over UDP and 89 over TCP once the extra TCP header and length prefix are counted.
Why does OpenVPN Performance matter?
It explains the classic complaint that a 1 Gbps circuit only delivers 300 Mbps over OpenVPN, and shows whether the fix is AES-NI, GCM or more daemons.
What values do I need to enter?
This calculator takes 6 inputs: Link rate, Cipher and CPU support, Transport and overhead, Average packet size, Path MTU, Parallel OpenVPN instances. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.