Calculate the effective throughput loss caused by VPN tunneling and encryption overhead.
Every VPN protocol wraps the original payload in extra headers for encapsulation, encryption, and authentication, and that added header consumes link capacity without carrying user data. The overhead percentage is the VPN header size divided by the total on-wire packet size (payload + header). IPsec (ESP in tunnel mode) typically adds 50-100 bytes depending on the cipher and authentication algorithm; OpenVPN adds 28-48 bytes depending on cipher and whether TCP or UDP is used; WireGuard has a fixed, minimal 32-byte overhead by design.
VPN overhead percentage
overhead% = vpn_header / (payload + vpn_header) × 100
Effective throughput
effective_throughput = link_bandwidth × (payload / (payload + vpn_header))
WireGuard has the lowest and most predictable overhead at a fixed 32 bytes per packet, since it uses a single modern cipher suite (ChaCha20-Poly1305) with a minimal, fixed-size header — no negotiable options to add extra bytes.
IPsec's ESP overhead depends on the chosen encryption cipher and block size (padding to the cipher's block boundary), the authentication algorithm (HMAC-SHA256 vs SHA1), and whether NAT-Traversal (UDP encapsulation) is in use, all of which add variable bytes.
Yes — the VPN header is a fixed number of bytes regardless of payload size, so it represents a larger percentage of a small packet than a large one. This is why VPN throughput loss is more noticeable with lots of small packets (e.g. VoIP) than with large file transfers.
No — VPNs also add CPU overhead for encryption/decryption and can add latency from the encapsulation process itself, though on modern hardware with AES-NI or ChaCha20 acceleration, throughput overhead from header bytes is usually the dominant, measurable cost.