VPN Bandwidth Calculator

Size the WAN circuit a remote-access or site-to-site VPN needs once encryption and encapsulation overhead is added.

About VPN Bandwidth Calculator

Concurrency turns a user population into a simultaneous load, and the ratio (payload + header) ÷ payload converts clear-text demand into ciphertext on the wire. Small packets pay the fixed ESP header far more often, so voice-heavy traffic inflates more than bulk file transfer. VPN circuits are billed on the encrypted rate, not the payload rate, so sizing on application throughput alone under-provisions the link by 8–15% and shows up as tunnel drops at peak.

Formula

VPN Bandwidth

tunnel Mbps = concurrent users × per-user rate × (packet size + encapsulation bytes) ÷ packet size.

per-user rate: Average application throughput per active user
encapsulation bytes: Bytes the VPN adds to every packet (56–73 for IPsec ESP)

Worked example

With the default values below, VPN Bandwidth Calculator returns Tunnel Bandwidth Required of 41.47. Change any input above and every figure here is recalculated in your browser.

Inputs used

Remote usersaccepts 1–100,000 users: 500 users
Per-user throughputaccepts 8–100,000 kbps: 256 kbps
Concurrent usersaccepts 1–100 %: 30 %
Average packet sizeaccepts 64–9,000 bytes: 700 bytes
VPN encapsulationone of IPsec ESP tunnel, AES-GCM (56 B), IPsec ESP tunnel, AES-CBC + SHA (73 B), IPsec ESP + NAT-T UDP (64 B), WireGuard (60 B), OpenVPN UDP (69 B): IPsec ESP tunnel, AES-GCM (56 B)

Results

Tunnel Bandwidth Required: 41.47 Mbps
Useful Payload: 38.40 Mbps
Encapsulation Overhead: 8.00%
Circuit Size with 25% Headroom: 51.84 Mbps
Concurrent Users: 150

Step by step

1Values used
2VPN Bandwidth
3Tunnel Bandwidth Required= 41.47 Mbps
4Useful Payload= 38.40 Mbps
5Encapsulation Overhead= 8.00
6Circuit Size with 25% Headroom= 51.84 Mbps
7Concurrent Users= 150

Assumptions and limits

The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is VPN Bandwidth calculated?

tunnel Mbps = concurrent users × per-user rate × (packet size + encapsulation bytes) ÷ packet size. Concurrency turns a user population into a simultaneous load, and the ratio (payload + header) ÷ payload converts clear-text demand into ciphertext on the wire. Small packets pay the fixed ESP header far more often, so voice-heavy traffic inflates more than bulk file transfer.

Why does VPN Bandwidth matter?

VPN circuits are billed on the encrypted rate, not the payload rate, so sizing on application throughput alone under-provisions the link by 8–15% and shows up as tunnel drops at peak.

What values do I need to enter?

This calculator takes 5 inputs: Remote users, Per-user throughput, Concurrent users, Average packet size, VPN encapsulation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.