Work out vpn throughput overhead instantly with clear inputs, formula shown and shareable results.
A VPN tunnel adds an outer IP header, the security protocol header, an initialisation vector and an authentication tag — roughly 57 bytes for IPsec with AES-GCM and about 32 for WireGuard. Effective throughput is the lower of the link and the crypto engine, multiplied by tunnel efficiency, which is why VPN appliances are rated separately for encrypted throughput.
VPN throughput
efficiency = payload / (payload + tunnel overhead); effective = min(link, crypto throughput) x efficiency
It has a compact fixed header and a single modern cipher suite with no negotiation, so both per-packet overhead and CPU cost are lower than IPsec's.
Substantially. AES-NI and dedicated crypto engines move the bottleneck back to the link, which is why crypto throughput should always be checked against the appliance datasheet.