VPN Tunnel Capacity
Calculate throughput capacity and tunnel count limits for site-to-site VPN connections.
About VPN Tunnel Capacity
A VPN tunnel's throughput is capped by the lower of two limits — the underlying physical link's bandwidth, or the VPN service/appliance's own rated per-tunnel throughput limit (many cloud VPN services cap a single tunnel around 1.25 Gbps regardless of link speed) — and then reduced further by encapsulation overhead from IPsec/IKE headers and encryption. Running multiple parallel tunnels (e.g. via ECMP or multiple connections) multiplies effective aggregate capacity, which is the standard way to exceed a single tunnel's throughput ceiling on high-bandwidth links.
Formula
Per-tunnel effective throughput
throughput = min(link_bandwidth, vpn_rated_limit) × (1 − overhead%)
- B
- Underlying link bandwidth
- L
- VPN tunnel's rated throughput limit
- o
- Overhead fraction
Worked example
With the default values below, VPN Tunnel Capacity returns Total Effective Throughput (all tunnels) of 1,700.00. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Underlying Link Bandwidthminimum 0.1 Mbps
- 1,000 Mbps
- VPN Tunnel Rated Limitminimum 0.1 Mbps
- 1,250 Mbps
- Protocol Overheadaccepts 0–50 %
- 15 %
- Number of Parallel Tunnelsminimum 1
- 2
Results
- Total Effective Throughput (all tunnels)
- 1,700.00 Mbps
- Effective Throughput per Tunnel
- 850.00 Mbps
- Throughput Lost to Overhead
- 300.00 Mbps
- Binding Constraint
- Underlying link bandwidth
- Per-Tunnel Cap (before overhead)
- 1,000.00 Mbps
Step by step
- 1Values used
- 2Per-tunnel effective throughput
- 3Total Effective Throughput (all tunnels)= 1,700.00 Mbps
- 4Effective Throughput per Tunnel= 850.00 Mbps
- 5Throughput Lost to Overhead= 300.00 Mbps
- 6Binding Constraint= Underlying link bandwidth
- 7Per-Tunnel Cap (before overhead)= 1,000.00 Mbps
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Why do cloud VPN services cap throughput per tunnel regardless of link speed?
Site-to-site VPN tunnels are typically processed by a single CPU core or crypto-processing path on both ends (an IPsec tunnel is inherently single-threaded per Security Association), so there's a hard ceiling independent of the underlying network link's raw capacity — many cloud providers publish this per-tunnel limit explicitly (e.g. ~1.25 Gbps).
How do I get more than one tunnel's worth of throughput?
Run multiple parallel VPN tunnels (common with ECMP-based multi-tunnel VPN configurations) and load-balance traffic across them, since each additional tunnel typically gets its own independent per-tunnel throughput allowance rather than sharing one combined limit.
Why does VPN overhead reduce throughput below the rated limit?
IPsec/IKE encapsulation adds header and authentication bytes to every packet (see the VPN Overhead calculator for the per-protocol breakdown), and encryption/decryption itself consumes processing resources — both reduce the actual usable payload throughput below the tunnel's theoretical rated capacity.
Which limit usually binds first: link bandwidth or the VPN rated limit?
On typical mid-size business connections (under ~1 Gbps), the underlying link bandwidth is usually the binding constraint. On very high-bandwidth links (multi-gigabit), the VPN service's own per-tunnel rated limit often becomes the bottleneck instead, since it doesn't scale with link speed.