If your connection becomes slow as soon as a VPN connects, first run the same throughput, latency, and packet-loss test with the VPN off and on. The VPN-off result is your raw link speed; the gap between the two results is the tunnel’s overhead from encryption, routing, and protocol processing. If both results are poor, repair the underlying ISP or Wi-Fi connection before changing VPN settings. If only the VPN result is poor, change one variable at a time—usually server location, transport protocol, CPU load, MTU, routing, or DNS—and test again.
There is no authoritative universal percentage for VPN speed loss. The size of the slowdown depends on your access link, path, server, hardware, protocol, and configuration. This guide shows how to identify the limiting component instead of guessing.
As an Amazon Associate I earn from qualifying purchases.
Start with a controlled VPN-off and VPN-on test
A single speed-test result cannot tell you whether the VPN is at fault. Build a baseline under repeatable conditions.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Use the same computer or phone for both runs. Ethernet or a stable Wi‑Fi connection is preferable; weak wireless signal can masquerade as VPN overhead.
- Pause cloud backups, game downloads, streaming, software updates, and other heavy traffic. A competing transfer can consume the link in either test.
- With the VPN disconnected, record download and upload throughput, latency, and packet loss. This is the raw link speed outside the tunnel.
- Connect the VPN to its current server and repeat the test against the same test service. Record the results rather than relying on how a web page feels.
- Run more than one sample if results fluctuate, keeping the test location and time as consistent as practical.
- Change only one setting before the next run. Otherwise you will not know which change helped or made the path worse.
| Observation | What it indicates | First action |
|---|---|---|
| VPN off and VPN on are both slow | The ISP, Wi‑Fi, local network, or access path is already the limiting factor. | Test another device or a wired connection, stop competing traffic, and investigate the base connection. |
| VPN off is fast; VPN on is slow | The tunnel path, server, protocol, encryption, MTU, routing, or DNS configuration is limiting performance. | Work through the VPN-specific checks below, one at a time. |
| Throughput is acceptable but pages and remote sessions feel sluggish | Latency, packet loss, DNS delay, or a distant route is affecting responsiveness. | Measure latency and loss, then compare a nearby endpoint. |
Why a VPN can reduce speed
A VPN encrypts packets, wraps them in a tunnel, sends them through a selected server, and then forwards them to the destination. That adds processing, headers, and an extra network leg. OpenVPN describes the difference between raw link speed and tunneled speed as the cost of encryption, routing, and protocol processing. The VPN cannot deliver more capacity than the underlying connection, and a private-tunnel server can also cap client downloads at the server’s own ISP upload speed or hosting limit.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Fix the underlying connection before tuning the VPN
Confirm the access link is healthy
If the VPN-off test is already slow, no Access Server tuning will repair that raw link. Compare Ethernet with Wi‑Fi, move closer to the access point, restart or reposition the wireless equipment if appropriate, and test another device. If every device is slow, check the ISP service status, modem or router statistics, and your subscribed rate. Escalate to the ISP only after ruling out a single-device or wireless problem.
Remove local contention
Temporarily stop large uploads, backups, video streams, and downloads. Upload saturation is especially important because acknowledgements and interactive traffic compete with it. Re-run the VPN-off and VPN-on tests after the competing transfer has stopped.
Try a nearer and less-loaded VPN server
A server’s advertised country is not a performance measurement. A distant endpoint adds propagation delay and usually more network hops; GL.iNet notes that data travelling farther from your physical location produces higher latency and slower speeds. A busy endpoint can also divide its capacity among many users.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Disconnect the VPN and record the baseline again if conditions changed.
- Choose an endpoint geographically close to you, unless you specifically need another country or private network.
- Run the identical throughput and latency test.
- If the nearby endpoint is still slow, try another nearby endpoint at a different load level. Keep the fastest measured option rather than the one that merely appears fastest in the app.
Distance is not the only variable. A nearby server with a congested uplink can perform worse than a slightly farther server with spare capacity. In a site-to-site or self-hosted tunnel, inspect the server’s ISP upload rate, cloud bandwidth quota, host shaping policy, and CPU utilization; the server’s outbound capacity can determine the client’s download speed.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Check CPU use and encryption acceleration
Encryption is work for both tunnel endpoints. Reproduce the slowdown while watching CPU utilization on the client and, when you administer it, the server. A core pinned near capacity while throughput plateaus points to a processing bottleneck rather than an ISP limit.
Client and server checks
- Check whether one process or one core is saturated instead of looking only at average CPU use.
- Verify that the processor supports and is using AES-NI or another available cryptographic acceleration feature. OpenVPN documents AES-NI checks as part of performance troubleshooting.
- Compare the configured cipher options when your VPN administrator permits it. A stronger or more expensive cipher can consume more processing capacity; do not weaken security policy merely to chase speed.
- For OpenVPN deployments that support Data Channel Offload (DCO), verify whether it is enabled and compatible with the operating system and configuration. DCO moves data-channel encryption and decryption into kernel space, reducing user-space processing overhead.
If CPU remains low and the server has ample capacity, look at route distance, congestion, packet loss, and MTU instead of repeatedly changing ciphers.
Compare UDP and TCP deliberately
Transport choice affects both throughput and compatibility. UDP generally provides the first performance test when the network allows it. TCP can be necessary on restrictive networks, but placing a TCP-based VPN inside another TCP flow can trigger the “TCP meltdown” behavior described in OpenVPN documentation: competing retransmission and congestion-control loops create delays and overcorrection.
| Transport | Typical advantage | Trade-off | When to test it |
|---|---|---|---|
| UDP | Lower protocol overhead and no nested TCP retransmission loop; often the better throughput starting point. | May be blocked or filtered by a restrictive network. | First, on a normal home or mobile connection that permits UDP. |
| TCP | Can pass through networks that allow only TCP traffic or tightly controlled ports. | Potential TCP-inside-TCP delays and lower throughput under loss. | When UDP fails to connect or the network requires TCP. |
Switch only the transport, leave the server and test method unchanged, and measure again. A TCP connection that feels steadier can still have lower bulk throughput; choose based on the traffic you actually need.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Test MTU when large transfers stall
The maximum transmission unit (MTU) is the largest packet a path can carry without fragmentation. A VPN adds encapsulation headers, so an MTU that worked without the tunnel can become too large inside it. Oversized packets may fragment or be dropped. Small pings can succeed while large file transfers, video calls, or certain websites stall.
Signs of an MTU problem
- Short connectivity tests succeed, but large downloads hang or repeatedly restart.
- Throughput collapses only on particular networks, such as a mobile carrier or hotel Wi‑Fi.
- Reducing packet size improves the transfer without changing the server or protocol.
Find a workable value
- Record the current MTU and reproduce the problem with the VPN connected.
- Test progressively smaller MTU values, changing only that setting and repeating the same large-transfer or throughput test.
- Use the largest value that passes reliably, then confirm it across the networks on which you use the VPN.
AWS documentation gives 1436 bytes as an example value associated with large-packet drops, while GL.iNet suggests trying 1380 or 1280 bytes in some mobile-carrier situations. These are diagnostic examples, not universal settings. The correct value depends on the access network, tunnel protocol, and encapsulation. If lowering MTU fixes the issue but causes unnecessary overhead, increase it step by step until failures return, then use the last reliable value.
Choose full or split tunneling knowingly
In full-tunnel mode, all internet traffic travels through the VPN server. That can be required by an employer or security policy, but it also adds the server’s latency, consumes its egress bandwidth, and may route public traffic through a distant geography. Split tunneling sends only selected private networks or applications through the tunnel and lets permitted public traffic use the ordinary connection.
| Routing mode | Traffic path | Performance and policy effect |
|---|---|---|
| Full tunnel | All internet traffic uses the VPN gateway. | Consistent policy coverage, but more server load, egress use, latency, and geographic detour. |
| Split tunnel | Only listed private networks or destinations use the VPN. | Can improve public-internet responsiveness and preserve local paths, but traffic outside the tunnel is not covered by VPN controls. |
Use split tunneling only when your organization’s policy permits it and you understand which traffic is outside the encrypted path. If a private service requires the VPN, add its network rather than excluding broad ranges blindly. After changing routes, verify both a private destination and an ordinary public destination; a fast test that bypasses the tunnel does not prove the VPN path improved.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Correct DNS handling
DNS delay can make browsing feel slow even when a throughput test is acceptable. In a full-tunnel configuration, use the VPN server’s DNS service or explicitly configured DNS servers so lookups follow the intended policy. OpenVPN guidance also calls for checking DNS reachability and the security-group or firewall rules that permit DNS traffic.
Diagnose lookup problems
- Compare the time to resolve a name with the VPN off and on.
- Confirm that the DNS server address supplied by the VPN is reachable through the tunnel.
- Review firewall, security-group, and access-control rules for DNS queries and replies.
- If split DNS is configured, verify that only the intended internal zones use VPN DNS and that public names use the permitted resolver.
Do not treat a resolver change as a cure for a saturated server or a distant route. DNS affects name-resolution time; it cannot increase the tunnel’s bulk capacity.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Measure latency, loss, and the route
Throughput alone hides path quality. Use a sustained ping, traceroute or MTR, and, where you control both endpoints, iperf3. Run the measurements with the VPN off and on and compare the destination path, not just one intermediate hop.
Recommended Free Tools
ping -c 20 destination.exampleprovides a sample of round-trip latency and loss on systems that support the-coption.traceroute destination.example(or the platform’s equivalent) shows where latency changes along the path.mtr destination.examplecombines repeated probes with route information and is useful for intermittent loss.iperf3between controlled endpoints measures the tunnel’s sustained throughput without relying on a public speed-test service.
OpenVPN cautions that loss reported at one intermediate hop may be router rate-limiting rather than a forwarding failure. Loss that begins at a hop and persists through later hops to the destination is more likely genuine. High latency can make remote desktops, calls, and interactive web use feel poor even when a bulk download remains fast.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Know when a VPN-capable router will help
A router with adequate CPU and native WireGuard or OpenVPN support can remove encryption and routing work from an underpowered laptop, phone, or older gateway. It is a reasonable upgrade when your measurements show the existing router’s processor is saturated or it lacks the protocol, MTU, or split-tunnel controls you need.
A new router will not fix a slow ISP, a distant or congested VPN endpoint, packet loss on the upstream path, or a remote server whose upload link is capped. Confirm the bottleneck with the VPN-off/VPN-on baseline before buying hardware. Compare the router’s stated VPN throughput under the protocol you will use, CPU capacity, firmware support, and the routing controls required by your network; do not compare ordinary Wi‑Fi speed alone.
A practical troubleshooting sequence
- Record VPN-off and VPN-on download, upload, latency, and loss using the same device, test location, and conditions.
- If both are slow, fix Wi‑Fi, local contention, the modem or router, or the ISP path first.
- If only the VPN result is slow, select a nearby endpoint and then another endpoint with less apparent load.
- Compare UDP and TCP while keeping every other setting unchanged.
- Watch client and server CPU, verify AES-NI or other acceleration, and check DCO where supported.
- Test MTU only when large packets or transfers fail, using progressively smaller values and treating 1436, 1380, and 1280 bytes as examples rather than defaults.
- Review full-versus-split routing and confirm that the traffic used for your test actually traverses the VPN.
- Check DNS reachability, firewall rules, and split-DNS zones.
- Use ping, traceroute or MTR, and iperf3 where available to separate loss and latency from throughput limits.
- After each change, repeat the same measurements, keep the setting that improves the result you care about, and document the final configuration.
Verify that the fix is real
Repeat the original controlled test at the end: same device, same access network, same test service, and the same VPN destination when comparing a single change. Confirm the applications that prompted the complaint—such as a large transfer, call, or remote session—rather than relying only on a speed-test score. If performance varies by time of day, record several samples; that pattern points toward congestion rather than a static MTU or cipher setting. Keep a short record of server, protocol, MTU, routing mode, DNS, and measured results so you can revert a change that helped one network but harms another.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
