VPN Slow Speed on VPS: Troubleshooting Guide

VPN slow speed on a VPS, dropping to 10-20 Mbps from an advertised 100 Mbps, is most often caused by insufficient resources (CPU, RAM), network congestion, a suboptimal route to the server, or misconfigured protocol settings, which can be diagnosed using iperf3 and speedtest-cli.

Many users deploying their own VPN on a virtual server find that the expected high speeds are not achieved. Instead of the 500 Mbps or 1 Gbps promised by their provider, real-world VPN speeds barely reach 50-100 Mbps, sometimes even dropping to 10-20 Mbps. This leads to frustration and questions: what causes such a performance drop? Can a self-hosted VPN on a VPS truly deliver high speeds, or is it a myth? Diagnosing why your VPN is slowing down your server requires a systematic approach. In this article, we'll break down step-by-step how to identify bottlenecks and take action to improve your VPN performance on a VPS.

Why is Your VPN on a VPS Slow?

The problem of slow VPN speed on a VPS rarely has a single cause. More often, it's a combination of several factors affecting throughput and latency. Understanding these factors is the first step towards effective diagnosis. Here are the main culprits:

• Insufficient VPS Resources: Your virtual server might be too weak for the chosen VPN protocol and number of concurrent connections. Lack of CPU, RAM, or slow disk I/O (though less critical for most VPNs) can be why your VPN is slowing down your server.
• Network Link Limitations: The VPS provider itself might offer a plan with an advertised 1 Gbps port, but the actual bandwidth to the internet or specific destinations can be significantly lower due to uplink congestion or internal limitations.
• Hypervisor Neighbor Congestion: On virtual servers (especially with overselling), the activity of other users on the same physical server can affect your VPS's performance, particularly network I/O.
• Inefficient VPN Protocol or Configuration: Some VPN protocols are more resource-intensive or less optimized for certain network conditions. For example, VLESS with Reality, while providing excellent obfuscation, may have higher overhead than, say, WireGuard. Incorrectly configured MTU can also lead to packet fragmentation and slowdowns.
• Routing Issues and Latency: The path from your device to the VPN server and then to the target resource can be long, pass through congested nodes, or have high latency. Geographical distance plays a role, but the quality of the route is often more important.
• ISP Throttling: Your home or mobile internet provider may actively throttle VPN traffic to reduce network load or due to regulatory requirements.

The goal of our diagnosis is to systematically rule out or confirm each of these causes to find the true culprit behind your slow VPN speed on a VPS.

Diagnosing VPS Speed: First Steps

Before blaming the VPN protocol or provider, you must ensure that the VPS itself can deliver the advertised speed. This is a crucial step in any VPS speed diagnosis. We will use two primary utilities: iperf3 for measuring bandwidth between two points (e.g., between your VPS and another server) and speedtest-cli for assessing speed to public Speedtest servers.

Measuring VPS Network Speed with iperf3

iperf3 is a powerful tool for measuring maximum network throughput. It allows you to check the "raw" speed of your VPS's network link, excluding the influence of VPN protocols and external factors like remote server load. For a comprehensive test, you'll need a second server (or your local PC with open ports) where iperf3 will also be running in server mode.

Installing iperf3 on VPS (Debian/Ubuntu):

sudo apt update
sudo apt install iperf3

Running iperf3 in server mode on one of your VPS instances:

iperf3 -s

The server will listen for connections on port 5201. Ensure this port is open in your VPS firewall.

Running iperf3 in client mode on another VPS or your PC:

iperf3 -c [IP_АДРЕС_СЕРВЕРА_IPERF3] -P 5 -t 10

Here:

• -c [IP_АДРЕС_СЕРВЕРА_IPERF3]: The IP address of the server running iperf3 -s.
• -P 5: Use 5 parallel streams for the test. This helps to better saturate the link and get more realistic figures for multi-threaded applications.
• -t 10: Test duration in seconds.

Interpreting the Results:

You will see the average throughput in Mbps. If your VPS has a 1 Gbps port, expected values should be in the range of 500-950 Mbps. If iperf3 shows significantly lower figures (e.g., 100-200 Mbps), this indicates a bandwidth limitation by the VPS provider itself or network infrastructure congestion.

Testing External Speed with speedtest-cli

speedtest-cli is a command-line version of the popular Speedtest.net service, which allows you to measure speed to the nearest public Speedtest servers. This is useful for assessing your VPS's "overall" internet speed, rather than just between two controlled points.

Installing speedtest-cli (Debian/Ubuntu):

sudo apt update
sudo apt install speedtest-cli

Running the test:

speedtest-cli

You can also choose a specific server for the test to assess speed to a particular region:

speedtest-cli --list | grep "City"
speedtest-cli --server [ID_СЕРВЕРА]

Interpreting the Results:

speedtest-cli will show ping, download speed, and upload speed. If these values are significantly lower than what iperf3 showed (e.g., iperf3 showed 800 Mbps, but speedtest-cli only 300 Mbps), this could indicate:

• Congestion on your VPS provider's external links.
• Routing issues to Speedtest servers (which can indirectly affect your VPN).
• Differences in testing methodologies (iperf3 is a more "rigorous" test).

If both iperf3 and speedtest-cli show low values (e.g., below 200-300 Mbps on a 1 Gbps port), the root of the problem is likely with the VPS's network link itself. In such a case, no VPN settings will help, and you should consider changing your VPS location or provider.

How to Check CPU and RAM Usage on Your VPS?

Even if your network link is ideal, insufficient CPU power or RAM can be why your VPN is slowing down your server. Encrypting and decrypting traffic, especially for high-speed connections and protocols with strong obfuscation, requires significant CPU resources. If 100 Mbps is no longer enough, a standard VPS might not suffice.

Monitoring Resources with top and htop

For real-time monitoring of CPU and RAM usage, use the top or htop utilities.

Installing htop (if not already installed):

sudo apt update
sudo apt install htop

Starting monitoring:

top

or

htop

Run one of these utilities, then actively use your VPN connection (e.g., download a large file or stream 4K video). Closely monitor the CPU and MEM (RAM) metrics for processes related to your VPN (e.g., xray, v2ray, openvpn, wireguard).

Interpreting the Results:

• High CPU Usage: If, during active VPN use, one or more CPU cores are consistently loaded at 80% or higher (especially a single process if the VPN is single-threaded), this is a clear sign that the processor is the bottleneck. For VPNs that don't parallelize well (e.g., OpenVPN without specific optimizations), this might mean you're hitting the limits of a single core's performance.
• Insufficient RAM: If the free RAM metric is consistently near zero, and swap is actively being used, this indicates a lack of available memory. While most VPNs don't require much RAM, some configurations or additional services on the VPS can consume it.

Impact of Multi-core vs. CPU Frequency

It's important to understand that for many VPN protocols (especially those using TCP tunnels), performance often depends on the speed of a single CPU core, rather than the total number of cores. This is because processing a single network stream often occurs within a single processor thread. Thus, a VPS with 2 cores at 2.5 GHz might be faster for a VPN than a VPS with 4 cores at 1.5 GHz if the VPN cannot effectively utilize all cores.

To check your VPS's CPU characteristics, use the following commands:

cat /proc/cpuinfo | grep "model name" | head -n 1
cat /proc/cpuinfo | grep "cpu cores" | head -n 1

If you find that the CPU is a bottleneck, this could be the reason for your slow VPN speed on a VPS. The solution might involve upgrading to a more powerful VPS plan with a faster CPU or optimizing your VPN configuration to reduce processor load.

How VPN Protocol and Configuration Affect Speed

The choice of VPN protocol and its correct configuration significantly impact the final speed. Different protocols have varying overheads for encryption, obfuscation, and connection management.

Protocol Comparison: VLESS, Shadowsocks, WireGuard, OpenVPN

• WireGuard: Known for its simplicity, high speed, and low latency. It uses modern cryptographic primitives and is very efficient, making it an excellent choice for those who need maximum throughput. However, WireGuard is less resistant to deep packet inspection (DPI) compared to obfuscated protocols.
• Shadowsocks: A proxy protocol designed to bypass censorship. It is lightweight and provides good speed. Its main advantage is the ability to disguise traffic as regular HTTPS, making it harder to detect and block.
• VLESS (Xray-core/v2ray): A modern protocol often used with additional obfuscation layers, such as Reality. It provides a high degree of protection against DPI by masking traffic as regular web traffic (e.g., TLS). However, this obfuscation adds computational overhead, which can lead to slow VLESS speeds compared to WireGuard on the same hardware. If you are using VLESS with Reality, ensure your VPS has a sufficiently powerful CPU.
• OpenVPN: An older but proven protocol. Highly flexible in configuration but can be significantly slower than others due to the use of older default cryptographic algorithms and the specifics of TCP tunnel implementations. Achieving high speeds with OpenVPN requires significant optimizations (e.g., UDP tunnel, AES-NI).

If you're experiencing slow VLESS speeds, try temporarily switching to WireGuard (if the situation allows) and compare performance. If WireGuard is significantly faster, the issue is likely with the VLESS/Reality overhead or its specific configuration.

Optimizing MTU and TCP/UDP Settings

MTU (Maximum Transmission Unit): This is the maximum size of a packet that can be transmitted without fragmentation. An incorrectly configured MTU can lead to packet fragmentation, which reduces data transmission efficiency and causes vpn slow speed fix issues. Ideally, the VPN tunnel's MTU should match your network's MTU or be slightly smaller. The standard value for Ethernet is 1500 bytes. For VPNs, it's often recommended to use a slightly smaller value, such as 1420-1472 bytes.

You can find the optimal MTU using the ping command on Linux/macOS:

ping -M do -s 1472 google.com

Gradually decrease the -s value (packet size) until packets stop fragmenting (-M do prevents fragmentation). The optimal MTU for your VPN will be this value + 28 bytes (for IP/ICMP headers).

TCP BBR: This is a TCP congestion control algorithm developed by Google. It significantly improves the performance of TCP connections, especially on links with high latency and packet loss. Enabling BBR on your VPS can significantly speed up TCP VPN tunnels.

Enabling TCP BBR on Linux:

echo "net.core.default_qdisc=fq" | sudo tee -a /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control=bbr" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

After this, reboot your VPS or check the status:

sysctl net.ipv4.tcp_congestion_control

It should show net.ipv4.tcp_congestion_control = bbr.

UDP Tunnels: If you use protocols that support UDP (e.g., WireGuard, OpenVPN in UDP mode, Hysteria), they often provide better speed and lower latency than TCP tunnels, especially on links with packet loss. UDP does not have the overhead of acknowledging every packet delivery, making it "faster" for streaming data. Protocols like sing-box with Hysteria support can be very effective.

Assessing the Route to Your VPN Server: traceroute and ping

Even the most powerful VPS with an ideal network link will be slow if the route to it is congested or experiences high latency. A poor route can be why your VPN is slowing down your server. Route diagnostics help identify problematic nodes.

Analyzing Latency and Packet Loss

Use traceroute (or the more advanced mtr) and ping utilities to assess the quality of the route from your local device to the VPN server. You can also perform tests in the reverse direction — from the VPS to your local IP (if it's static and accessible) or to a popular resource you frequently access via VPN.

ping: Checks latency and packet loss to a target IP address.

ping [IP_АДРЕС_VPS]

High ping values (e.g., >150 ms for a server on another continent, >50 ms for a neighboring country) or frequent packet loss (packet loss) indicate issues with latency or connection stability. If the ping to the VPS is good, but the ping to the target resource through the VPN is high, this could be a routing problem from the VPS.

traceroute / mtr: Shows the full path (route) from your device to the VPS, as well as the latency to each intermediate node (hop).

Installing mtr (Debian/Ubuntu):

sudo apt update
sudo apt install mtr-tiny

Running mtr (from your PC to the VPS):

mtr [IP_АДРЕС_VPS]

mtr continuously sends packets and shows the latency and percentage of loss for each node on the route. This is much more informative than a single traceroute.

Interpreting mtr Results:

• High Latency on a Hop: If latency sharply increases at an intermediate node and remains high for the rest of the route, that node might be congested or geographically distant.
• Packet Loss on a Hop: If significant packet loss (>1-2%) is observed at a particular node, it indicates serious issues with that node or the link to it. If losses continue to the end of the route, this confirms the problem.
• Asterisks (***) in Output: May mean that the node is not responding to ICMP requests (not necessarily a problem), or that packets are indeed being lost. If the route continues after asterisks and latencies are normal, it's likely just ICMP filtering.

If the route to your VPS passes through several countries or continents with many hops exhibiting high latency or loss, this could be the primary cause of slow VPN speeds. In this case, it might be worthwhile to choose a VPS in a more optimal geographical location that is closer to you or has better routes to your target resources.

ISP Throttling vs. Noisy Neighbors: How to Distinguish?

Two less obvious but common causes of slow speeds are the "noisy neighbor" effect on the hypervisor and active throttling by your internet service provider. These factors are harder to diagnose, but there are certain signs.

Signs of "Noisy Neighbor" Influence on the Hypervisor

On VPS hosting, your virtual server shares physical resources (CPU, RAM, disk, network card) with other VPS instances on the same physical hardware (hypervisor). If one or more "neighbors" actively use resources, this can negatively impact your VPS's performance — known as the "noisy neighbor" effect.

How it manifests:

• Unstable Speed: iperf3 or speedtest-cli results can vary significantly from test to test. At one moment, you might get 500 Mbps, and at another, 100 Mbps, with no apparent reason.
• High IO wait: Even if your VPN isn't actively using the disk, high disk activity from neighbors can slow down the entire system. You can check this using iostat (sudo apt install sysstat, then iostat -x 1). If the %iowait column consistently shows high values (e.g., >10-20%), this could indicate a problem.
• "Lags" and Micro-freezes: If the VPN connection periodically "freezes" for short periods, it might be due to the hypervisor temporarily reclaiming resources from you.

What to do: If you suspect neighbor influence, try contacting your VPS provider's support. Some providers may offer to migrate your VPS to another physical server with less load. As a last resort, consider switching to more "isolated" plans (e.g., KVM with guaranteed resources) or to another provider that does not practice aggressive overselling. Choosing a VPS with guaranteed resources is especially important for stability.

How to Detect ISP Throttling

Throttling (speed limitation) of VPN traffic by your home or mobile internet provider is a common problem. Providers may use deep packet inspection (DPI) to detect and limit VPN traffic to reduce network load or due to regulatory requirements.

Signs of throttling:

• High speed without VPN, low and consistently limited with VPN: If direct connections show high speed, but the VPN connection (even using different protocols and servers) is consistently limited to a certain value (e.g., exactly 10 Mbps or 50 Mbps), this is a strong sign of throttling.
• Speed drops only with active use: The provider might not throttle VPN traffic at low speeds but starts limiting it once you reach a certain threshold (e.g., 20 Mbps).
• Different protocols yield different speeds: If WireGuard is heavily throttled, but VLESS with Reality works faster, this indicates that the provider has learned to recognize less obfuscated traffic.

What to do:

• Use obfuscated protocols: Protocols that mask VPN traffic as regular web traffic (HTTPS), such as VLESS Reality, Trojan, Hysteria (with obfuscation), or Shadowsocks with plugins, are significantly harder to detect and throttle. Hiddify on VPS or Nekoray/v2rayN for VLESS Reality can be effective solutions.
• Change port: Sometimes changing the standard VPN port (e.g., 443 for VLESS/Reality) to another, less obvious one, can help.
• Test with a different internet provider: Try connecting to the VPN via another network (e.g., mobile internet from a different operator or a friend's Wi-Fi). If the speed is significantly higher, the problem is definitely with your home provider.

How to Speed Up VPN on VPS: A Comprehensive Approach and Solutions

After conducting the diagnostics, you should have an understanding of the primary bottleneck. Now, let's explore how to speed up your VPN on a VPS by applying the knowledge gained.

Server and Client Configuration

If the problem is not with the VPS itself or the global route, then optimizing the configuration can significantly improve the situation. Here is a list of recommendations:

1. Update Kernel and OS: Ensure your VPS is running on an up-to-date Linux kernel. Newer kernels often include network stack and driver improvements.
2. Enable TCP BBR: As mentioned earlier, enable BBR for TCP tunnels. This can significantly improve performance, especially on links with packet loss or high latency.
3. Choose an Optimal Protocol:
   • If maximum speed is the priority and strong obfuscation isn't needed, use WireGuard.
   • If obfuscation is necessary to bypass blockages but speed is also important, consider VLESS Reality or Hysteria. Ensure your VPS has a sufficiently powerful CPU to handle them.
   • Avoid older or unoptimized protocols, such as OpenVPN in TCP mode without special settings, if speed is a critical factor.
4. MTU Configuration: Experiment with MTU. Start with 1420-1472 bytes on both the server and client. Ensure your client device (e.g., iPhone with Shadowrocket or Android with v2rayNG) also uses the correct MTU, if possible.
5. VPN Server Configuration Optimization:
   • For Xray/V2Ray: Use up-to-date versions. Check buffer settings, disable unnecessary logs. Ensure sniffing is configured correctly or disabled if not needed.
   • For WireGuard: Ensure the configuration is simple and efficient.
6. Use Current Client Versions: Outdated VPN clients may have bugs or not support the latest optimizations. Update your client software (e.g., Sub-Store for VLESS).
7. Firewall Configuration: Ensure your firewall (e.g., UFW, nftables) on the VPS is not blocking or slowing down traffic. Simple rules usually don't affect speed, but complex chains or restrictions can.
8. VPN on Router: If you are using a VPN on a router, ensure the router itself is powerful enough to handle encryption at high speeds. Many consumer routers have weak CPUs.

When to Upgrade Your Plan or Change Location

If all software optimizations have been tried and speed is still low, it means you've hit hardware or network limitations. In this case, solutions may include:

• Upgrade to a More Powerful VPS Plan: If diagnostics revealed insufficient CPU or RAM, you need a VPS with more cores, a higher CPU frequency, or more RAM.
• Change VPS Location: If the problem is routing or high latency, choosing a VPS in a different country or even a different data center within the same country can dramatically change the situation. Focus on locations that have better routes to your region or to your target resources.
• Choose a Different VPS Provider: Sometimes the issue isn't the plan but the provider's overall infrastructure (congested uplink, aggressive overselling). Switching providers can yield better results.
• Transition to a Dedicated Server: If you need very high and stable speeds (e.g., over 500 Mbps for many users) and regular VPS instances aren't cutting it, it might be time to consider a dedicated server. It provides all resources exclusively to you, eliminating the "noisy neighbor" effect.

For 5-10 concurrent users actively consuming traffic, 2 vCPU, 4 GB RAM, and a 40 GB NVMe disk are sufficient, providing a stable 100-200 Mbps.

Users	vCPU	RAM	Disk	Port	Price (approx.)
1-3 (light browsing)	1	1-2 GB	20 GB SSD	1 Gbps	from $5/month
5-10 (active browsing, streaming)	2	4 GB	40 GB NVMe	1 Gbps	from $10/month
10-20 (multiplayer gaming, 4K streaming)	4	8 GB	80 GB NVMe	1 Gbps	from $20/month
20+ (corporate needs, high load)	6+	16+ GB	160+ GB NVMe	1-10 Gbps	from $40/month

Frequently Asked Questions

Why is my VLESS VPN slower than WireGuard on the same VPS?

Slow VLESS speeds, compared to WireGuard, are often due to higher computational overhead for encryption and obfuscation, especially when using VLESS Reality. WireGuard is designed for maximum speed with minimal resource usage, while VLESS/Reality focuses on censorship circumvention by masking traffic as HTTPS, which requires more CPU. For VLESS, 2 vCPU and 4 GB RAM are consistently needed for speeds above 200 Mbps.

How can I distinguish between ISP throttling and insufficient VPS resources?

ISP throttling manifests as a stable limitation of VPN speed to a certain value (e.g., 50 Mbps), regardless of VPS load or time of day. Insufficient VPS resources typically lead to reduced speed under high CPU load (top/htop monitoring will show 80-100% utilization) or unstable speed test results. Check your VPS speed without a VPN using iperf3 and speedtest-cli. If it's high, but low with the VPN, it's more likely throttling.

What amount of RAM and CPU is needed for a stable VPN for 10-15 users?

For 10-15 active users engaged in streaming or gaming, a VPS with a minimum of 4 vCPU and 8 GB RAM is recommended. This will provide sufficient performance for handling encryption and multiple concurrent data streams. An NVMe disk and a 1 Gbps port are also important. The cost for such a server typically starts from $20-25/month.

Can MTU affect VPN speed, and how do I configure it?

Yes, an incorrectly configured MTU can significantly reduce VPN speed by causing packet fragmentation and retransmissions. The optimal MTU value is usually in the range of 1420-1472 bytes. You can find it using the command ping -M do -s [размер_пакета] [ip_адрес] on Linux/macOS, gradually decreasing the packet size until fragmentation disappears. Set the found value in your VPN server and client configurations.

Conclusion

Diagnosing slow VPN speed on a VPS is a multi-step process that requires systematically checking the network link, VPS resources, protocol configuration, and route. Most issues can be resolved by optimizing settings and choosing the right protocol, but sometimes upgrading your VPS plan or changing its location is necessary to achieve desired performance. Always start by checking your VPS's baseline speed with iperf3 and speedtest-cli before delving into specific VPN settings.