Let's say you wanted to transfer a 1 GB file from a machine at site 1 to a machine at site 2. You can either connect the two machines via a VPN (L2TP) or basic port forwarding. Which connection method would move the file faster (or would it be a tie?), and why?

  • 2
    What do you mean by "basic port forwarding"? – Michael Hampton Nov 19 at 9:21
  • Rather than tunneling using a configuration where a router will forward traffic for a certain port to a machine in its network – Kirk Ouimet Nov 19 at 15:12

Port forwarding would be quicker, but it would be less secure, in the sense that there is no confidentiality, or integrity. If you don't care then it is not a problem. Any VPN or tunnelling will add overhead, both in terms of the Packet header, and processing on the gateway that is encrypting and encapsulating your data. Different VPN technologies can use varying levels of encryption and hashing, and often that is also supported in the hardware of devices.

The actual speed and throughput you receive will be dependent on quite a few variables. You also need to consider the protocol you use for the transfer, and the latency of the end to end connection. Protocols like CIFS are very bad over a WAN circuit as they do not have effective TCP window scaling, so your total throughput is constrained by your round trip latency. sftp is much better of a WAN link and it would also provide encryption. SCP not as fast, but still pretty effective.

| improve this answer | |
  • 2
    With modern CPUs the bottleneck is usually moved to how much data payload is in each transmitted data packet, and just how fast is your internet. Unless you have a 10gbps connection on both ends, then CPU overhead will come in to play. The amount of data overhead SlyOne is talking about is usually only a few percent for a VPN these days. You can usually watch this efficiency by comparing the bandwidth going through the router to the source or destination disk usage if not much else is happening on that disk. With most VPNs also doing compression this changes depending on data. – BeowulfNode42 Nov 23 at 0:22

I don't think you'd have a relevant performance gain for this specific example. Nonetheless, bear in mind a layer 2 to VPN would handle more traffic, like broadcasts, ARP packets, and NetBIOS packets.

If your need is just forwarding a specific service/port, I'd rather go with port forwarding and denying incoming packets to anything else that doesn't need to be exposed.

Bear in mind that, enabling a L2 VPN you're somehow exposing all your nodes to both networks. If you trust both networks and it sounds OK, well, no problem. If it doesn't, expose only what need to be exposed.

| improve this answer | |
  • A layer 2 VPN is not the only option. Most VPN suites these days default to a layer 3 routed setup, where none of the broadcast traffic is transmitted. Try something like TincVPN (tinc-vpn.org) or OpenVPN community edition (openvpn.net/community-downloads-2). Popular router distro's like pfsense (pfsense.org) have nice gui's built in or as a simple addon available. – BeowulfNode42 Nov 23 at 1:05
  • @BeowulfNode42 I have faced some scenarios where a L2 VPN was needed because of some legacy requirements. As I said, if I can choose, I rather go with port forwarding, but sometimes I can't choose for a L3 VPN. – surfingonthenet Nov 23 at 1:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.