VPN Throughput Degradation Calculator
WireGuard loses 4.2%. IPsec ESP in tunnel mode loses 6–8%. OpenVPN over TCP: up to 30% gone. The TCP-over-TCP retransmission problem is not a configuration error — it is baked into the protocol design. Model real throughput before you provision. The spec sheet number is not what your application sees.
🔐 Tunnel Configuration
Set link bandwidth, VPN protocol, and MTU. The model accounts for per-packet header overhead, encryption padding, TCP-over-TCP retransmission penalty, and MSS fragmentation cost. Compare all seven protocol configurations side by side at your link speed.
Why VPN Throughput Never Matches Link Speed
Every VPN tunnel wraps your original packet inside a new one — adding outer IP headers (20 bytes), UDP/TCP headers (8–20 bytes), protocol-specific framing, initialization vectors (IV), and authentication tags. For a 1420-byte MTU payload, WireGuard adds 60 bytes of overhead (4.2% loss), while IPsec ESP in tunnel mode adds up to 73 bytes (5.1%). These numbers compound with TCP MSS clamping — if the inner TCP stack doesn't know about the reduced MTU, packets fragment and throughput collapses.
The TCP-over-TCP Meltdown
OpenVPN in TCP mode suffers from a fundamental protocol flaw: two TCP layers compete for retransmission control. When the outer tunnel TCP retransmits, the inner TCP also retransmits — creating a multiplicative backlog that can consume 20–30% of link capacity. Always prefer UDP-based VPN transports (WireGuard, IPsec, OpenVPN UDP) for anything carrying TCP traffic.
Quick Reference: Overhead by Protocol
| Protocol | Per-Packet Overhead | Effective % | TCP Safe? |
|---|---|---|---|
| WireGuard | 60 bytes | ~95.8% | ✅ Yes (UDP) |
| GRE (no encrypt) | 24 bytes | ~98.3% | ✅ Yes (IP) |
| IPsec ESP AES-GCM | ~73 bytes | ~94.9% | ✅ Yes (ESP) |
| IPsec ESP AES-CBC+HMAC | ~89 bytes | ~93.7% | ✅ Yes (ESP) |
| OpenVPN UDP AES-GCM | ~53 bytes | ~96.3% | ✅ Yes (UDP) |
| SSTP (SSL/TLS) | ~60 bytes | ~95.8% | ⚠️ TCP-over-TCP risk |
| OpenVPN TCP | 53 + TCP retrans | ~70–80% | ❌ TCP-over-TCP |