Site-to-Site Bandwidth Calculator

July 27, 2026

VPN and WAN capacity planning

Site-to-Site Bandwidth Calculator

Estimate required WAN speed for a site-to-site tunnel from user traffic, replication, backup data, voice and video streams, VPN overhead, compression, peak concurrency, and QoS reserve.

⚙Site VPN presets
📊Bandwidth inputs
People or active clients that can use apps across the tunnel.
Typical busy-hour app traffic per concurrent user.
Continuous database, VM, NAS, or object sync before compression.
Data that must cross during the overnight planning window.
Concurrent calls, meetings, NVR previews, or intersite media streams.
IPsec, WireGuard, OpenVPN, GRE, MTU padding, ACKs, and framing.
Reduction for compressible backup and replication payloads.
Share of users active at the same busy-hour moment.
Capacity held back for jitter, retransmits, failover, and priority queues.

Site-to-site WAN sizing result

Required WAN
0
Mbps
Circuit speed after payload, tunnel overhead, and QoS reserve.
Tunnel overhead
0
Mbps
Extra bandwidth consumed by encapsulation and framing.
Backup time
0
hours
Estimated completion using the planned backup lane.
Headroom
0
Mbps
Reserved capacity above normal encrypted traffic.
Ready.

Traffic breakdown

Capacity mix

User traffic share
Backup and replication share
QoS reserve share

The calculator assumes an 8 hour backup window and 2.4 Mbps per voice/video stream as a blended planning value. Use a higher per-user Mbps value when SaaS, RDP, SMB, or camera preview traffic is heavier.

🛠Spec grid
8 hr
Backup Window
2.4
Mbps Per Stream
IPsec
Common Tunnel
MTU
Overhead Driver
QoS
Reserve Layer
TCP
ACK Sensitive
DR
Sync Use Case
WAN
Sizing Output
🔗VPN overhead reference
Tunnel typeTypical overheadPlanning noteWhen to raise it
WireGuard site tunnel10% to 15%Efficient UDP encapsulation with simple crypto path.Small MTU, roaming links, or packet loss.
IPsec ESP tunnel15% to 25%Good default for branch VPN and firewall appliances.NAT-T, GRE, small packets, or double encryption.
OpenVPN over UDP20% to 30%Useful when compatibility matters more than raw speed.User-space CPU limits or high packet rate flows.
IPsec plus GRE25% to 35%Common when dynamic routing or multicast needs a wrapper.Low MTU WAN, many voice packets, or nested tunnels.
💾Backup window reference
Data crossing WANMbps for 8 hrWith 25% compressionPlanning note
50 GB14.2 Mbps10.7 MbpsSmall NAS, photos, or config backups.
250 GB71.1 Mbps53.3 MbpsTypical nightly VM incrementals or file deltas.
1 TB291 Mbps218 MbpsNeeds a fast uplink or longer window.
4 TB1165 Mbps874 MbpsSeed locally or use staggered replication jobs.
📍Common site-to-site profiles
ScenarioTraffic shapeSuggested reserveImportant bottleneck
Home to VPSLow users, light apps, small backup deltas.15% to 20%Residential upload and variable latency.
NAS offsite backupBackup dominates, users are secondary.20% to 25%Disk read rate, compression CPU, ISP upstream.
Branch officeApps, VoIP, SaaS hairpin, print, identity traffic.20% to 30%Busy-hour concurrency and QoS discipline.
Cloud DR syncContinuous replication plus burst catch-up.25% to 35%Snapshot churn and retransmits during spikes.
✅WAN planning checklist
CheckWhy it mattersRule of thumbAction
Measure upload, not downloadMany site VPNs are limited by the smaller upstream.Use 95th percentile busy-hour tests.Test both directions with iperf3 or appliance telemetry.
Separate real-time queuesVoice and video need low jitter more than raw Mbps.Keep at least 15% free after priority traffic.Shape below ISP rate and classify DSCP carefully.
Stagger backupsBackup bursts can starve SMB, RDP, database, and POS traffic.Prefer smaller deltas over one large transfer.Schedule jobs outside peak user and replication periods.
Watch MTUNested tunnels and small packets inflate overhead.Confirm path MTU before blaming the ISP.Set MSS clamping and monitor retransmits.
💡Practical tips
Shape below the ISP rate. QoS works best when your firewall, router, or SD-WAN box controls the queue before packets hit the modem or carrier handoff.
Model each direction. A backup-heavy branch may need far more upload at the source than download at the destination, especially on asymmetric residential links.
Compression is workload-specific. VM images, databases, and documents may shrink well. Video, photos, encrypted archives, and already compressed backups usually will not.
Keep tunnel CPU in mind. The WAN plan is only useful if the firewall, mini PC, VPS, or router can encrypt at the required packet rate.
This tool is a planning calculator, not a carrier SLA. For production VPNs, validate with live throughput tests, latency graphs, packet loss, firewall CPU, and application response time during the busiest hour.

Maybe you upgraded to a higher-speed internet circuit only to find out your VoIP calls still get garbled. It doesn’t make sense, but there is more to bandwidth than just bits per second, there are many kinds of traffic competing for bytes on the wire. When a company connects two sites, rarely does this mean there is simply a download pipe from one location to another. More likely, there are all sorts of voice packets that is sensitive to delay. There are also heavy backup job running during off hours and tunneling protocols adding weight to each packet that goes down the wire.

Before you size or buy a link, the capacity estimator above consider several factors. These include QoS reserve, tunnel overhead, replication, and compression. It also accounts for real-time streams, backups, and VPN user. The first thing most folks do is count heads: how many users are in each branch office? Multiply that times some generic per-user bandwidth number. That’s fine as a beginning but it doesn’t reflect busy-hour reality. Not all your users are going to hit the network at exactly the same instant… but you’ll still have enough to clog things up if you don’t account for concurrency.

How to Choose the Right Internet Speed

The tool lets you play with peak concurrency percent… Which models this reality: half your team might hop on a conference call, while somebody else starts a big file transfer. To avoid dropping any packets, you want some headroom to allow for these kinds of coincidences. But then there’s the cost of encryption, the secret cost. Encrypting your traffic adds extra work and headers to each packet. It’s not free space.

The table on the page lays it all out by showing how much additional bandwidth each kind of tunnel consume. Depending on your configuration, you could be adding ten percent overhead with a simple WireGuard setup and pushing closer to thirty-five percent with something like a nested IPsec plus GRE configuration. That can make the difference between a smooth connection and one where everything constanty hits the ceiling. When you size a circuit, don’t ignore the weight of the protocol. The ISP doesn’t see your plaintext data. They see the encrypted blob and they charge you for every bit of it.

The other wrinkle is backup traffic. If you’re not compressing and shaping your large nightly backups correctly, you can very easily swamp a link. By assuming this job runs over an eight-hour window, the calculator has forced you to consider if your existing bandwidth are enough to shift your daily deltas within this period. Compression helps at this stage, however, provided you have compressable data. Highly optimised media files or archives that are already encrypted won’t help you here. Which brings me back to my point about understanding your workload being more important than pursuing theoretical speeds. A twenty-megabit pipe may well feel speedy when surfing the web but attempt to push fifty gigabytes of raw database logs across it without compression and it’s going to feel like molasses.

In contrast, voice and video are something else altogether. These applications don’t require huge amounts of throughput, they absolutely can’t deals with latency spikes or jitter, though. That’s where the idea of reserving capacity for Quality of Service comes in. In other words, if your network gets busy, you want to know that critical traffic like this will still get through. With the calculator, you can set aside a reserve percentage to keep these streams protected from being buried by bulk data transfers. It may be a small thing but it will prevent the sort of laggy video meetings that make remote work feel like torture.

And lastly, think about how unbalanced most home or small business connections are. In site-to-site situations, upload speed is frequently the choke point, particularly if you’re replicating local data to a destination such as the cloud, or backing things up. Having lots of download capacity won’t help if your upload sucks. Don’t trust ISP marketing figures; test what you actualy get at peak usage times. Measure the real world, not the brochure.

A WAN link isn’t so much choosing a large number as it is finding a balance among conflicting needs. How long can you tolerate backup? How much should you pay for the circuit? How far away does your site has to be from the other end of the tunnel to get good performance? Does it need to support high throughput or low latency? Is the connection sensitive to jitter?

Strike the correct balance and the line will stand up to load. Miss the mark and you’ll be running out to upgrade your cable, only to continue chasing latency problems because the root cause was congestion. You would of wanted a network that seems fast while working hard.

Site-to-Site Bandwidth Calculator

Related posts

Leave a Comment