[New] VPN Performance Results (Wireguard, IPSec, OpenVPN)

TL;DR: This article was made to provide expected VPN throughput on every Vault product when configured in a site-to-site configuration, for every kind of VPN protocol (tested on OPNsense). Scroll down to the VPN Throughput Results section to view the numbers. 

A VPN (Virtual Private Network) establishes an encrypted connection between a device and a remote server over a public or untrusted network. It enables secure transmission of data by encapsulating network traffic, masking the user's IP address, and maintaining privacy and integrity across the connection. These can also be used to remotely connect to remote office locations for businesses.

There are two major types of VPN connections: client-based VPNs (commonly used with VPN providers) and site-to-site VPNs.

In client-based VPNs, individual users connect to a remote VPN server operated by a provider such as Proton VPN, NordVPN, or Mullvad VPN, to name a few. The connection is typically established using protocols like OpenVPN, WireGuard, or IKEv2/IPsec, which handle authentication, encryption, and tunnel negotiation. These VPN clients can be run directly on an endpoint device (e.g., a laptop or smartphone) or configured manually on network appliances or firewalls like OPNsense or pfSense®, allowing all devices behind that firewall to use the tunnel.

In a site-to-site VPN, two networks, typically each protected by a firewall, are connected securely over the internet. Each site uses a public IP address to establish a persistent encrypted tunnel to the other. This setup allows devices on either network to communicate with each other as if they were on the same local network. Site-to-site VPNs are often configured using IPsec, OpenVPN, or WireGuard, and are commonly used for secure communication between branch offices or data centers.

VPN performance is a popular metric used to determine what kind of Protectli Vault product may work for you. Typically, more powerful CPUs will be able to provide higher throughput on a VPN connection. Data throughput on a VPN connection will inherently be lower than unencrypted traffic due to the computational overhead introduced by encryption and encapsulation processes. Each packet must be encrypted and decrypted in real-time, which consumes CPU resources, especially with protocols like OpenVPN, which are single-threaded and CPU-intensive. Additionally, the type of encryption algorithm used (e.g., AES-256 vs ChaCha20), the VPN protocol, and whether the device supports hardware acceleration for cryptographic operations (such as AES-NI) can all significantly impact VPN throughput. This article is made to provide expected VPN throughput on every Vault product when configured in a site-to-site configuration, for every kind of VPN protocol. Real world results can vary, and this should also assist with "guestimating" what kind of throughput speeds you may get with a VPN provider.