I have the following topology at the workplace:

enter image description here

The Main Gateway that you see on the picture is the office default gateway. The other appliance the VPN gateway, is another gateway in the same network and it is used to create VPNs.

The thing is that the VPN Gateway and the internet there is 10GBps and the Main Gateway speed is 1GBPs.

When we create the VPNs to the other networks, we put the routes on the Main Gateway pointing for the VPN Networks via the VPN Gateway.

My question is, since I am using the main gateway for route redirection but its interface is considerably slower, would that affect the speed of the traffic that goes through the VPN? Will that throttle the traffic down to 1GBps?

My expectation is that the traffic will just bounce of the Main Gateway and I will still get 10GBps speed, but I am not sure.


It depends on your main gatway and on your hosts.

Normally in this situation the main gateway will issue an ICMP redirect message to the host, with the IP address of the VPN gateway, informing the host that a better route is available.

The host should afterward send traffic directly to the VPN gateway.

So if your router correctly send the ICMP redirect and if the host operating system handles it correctly, the host should communicate directly with the VPN gateway and thus be able to use the full 10Gbs bandwidth.

If the host ignores the the ICMP redirect message (or if the main gateway doesn't send it, or if it is blocked by a firewall, either on the gateway or on the host) all traffic will go through the main gateway and will be limited by the main gateway interface bandwidth (which is likely also used by other flows).


  • while issuing the ICMP redirect message, the main gateway still forward the packet to the second router, so the communication does happen, even when the host doesn't receive / ignore the ICMP redirect message.

  • in all cases traffic from the VPN gateway is sent directly to the host without going through the main gateway. So the communication speed can be asymmetric, 1Gbs in one direction, 10Gbs in the reverse path.


A small addition to JFL's nice answer:

If you can't use ICMP redirect, I'd recommend setting up the VPN gateway as the default gateway for the clients. It'll probably already know which routes should go into the VPN tunnel - just point the VPN gateway's default route to the main gateway and Internet traffic will be routed over.

If you want perfect efficiency you'd need a central router. We're using our L3 core switch as default gateway and simply set up all required routes there. This takes care of routing and switching at the same time and is highly efficient.

  • Thx for the addition Zac67 – Spirit Apr 21 '18 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.