A VPN always slows things down a little — the question is by how much. With the right location and protocol the loss stays within 5–15%, and if the internet through the tunnel is twice as slow, there is a specific cause you can find. Here are eight causes in order — from the distance to the server to MTU.
This article is built as a diagnostic: first measure correctly, then rule out causes one by one. For each one — what’s happening and what to change.
How to measure speed correctly
Most complaints about a slow VPN come from a single measurement taken at a bad moment. Before changing anything, get numbers you can actually trust.
- Turn off the VPN and measure speed and latency to a test server in the same country as your VPN location.
- Turn on the VPN and, a minute later, repeat the measurement against the same test server.
- Take three measurements in each state and compare the medians, not the best results.
- Note the protocol, the location, the network type (2.4 or 5 GHz Wi-Fi, cable, LTE) and the time of day.
- Repeat on another network: if the difference between home and LTE is bigger than between “with VPN” and “without”, the cause is the network, not the VPN.
Comparing speed to a Russian test server without the VPN against a European one with the VPN isn’t valid — you’re measuring different routes. The test should go to the same point both times.
Distance and choosing a location
Every 1,000 km adds about 10 ms of one-way latency, and with the return path and intermediate nodes, 20–30 ms. That’s unnoticeable for loading pages, but noticeable for games and calls. TCP connection speed depends on latency too: the higher it is, the slower a connection ramps up and the more packet loss hurts it.
| Location | Latency | When to choose it |
|---|---|---|
| Helsinki, Stockholm, Warsaw | 25–45 ms | Everyday work, games, calls |
| Amsterdam, Frankfurt, Zurich, Paris, London | 40–70 ms | Video, major services, stable connectivity |
| Istanbul, Tel Aviv, Dubai, Almaty | 50–90 ms | Regional services, alternative routes |
| New York, Toronto, Atlanta | 120–160 ms | Only for services tied to North America |
| Tokyo, Singapore, Hong Kong, Mumbai, São Paulo | 150–300 ms | Only for regional tasks |
The numbers depend on your ISP and its connectivity. Practical advice: keep your main location the closest one and switch to distant ones for a specific task. Changing location in the app takes seconds, and a personal server deploys in a new location within minutes. For users in Russia, a good starting point is usually the Netherlands or Finland.
The protocol and its overhead
The protocol determines how much overhead is added to every packet and how much processor time goes into encryption. The difference between modern and older protocols is several times over.
| Protocol | Speed on a clean network | Resilience to filtering | Processor load |
|---|---|---|---|
| WireGuard | Maximum | Low, easily recognised | Minimal |
| MeduzaVPN | Close to WireGuard | Medium | Minimal |
| MeduzaVPN ULTRA | High | High | Low |
| VLESS | High | High | Low |
| Shadowsocks | High | Medium | Low |
| OpenVPN | Low, especially over TCP | Low | High |
If the network isn’t interfering, choose WireGuard or MeduzaVPN. If it is, choose ULTRA or VLESS: they’re a bit heavier but work where WireGuard drops or slows down. Save OpenVPN for cases where nothing else gets through: it’s slow by design, and in TCP mode it suffers further from double delivery control.
Mobile networks, throttling and DPI
If the VPN is fast at home but barely works on LTE, the cause is usually not the network speed but the carrier’s deep packet inspection equipment. It recognises a protocol by its signatures and behaviour and may not block the connection outright, but throttle it to a few megabits or cut it after a few minutes.
Signs that filtering, not the network, is the cause:
- The connection establishes, but speed is tens of times lower than without the VPN.
- It’s fast for the first few seconds, then suddenly slows down.
- Switching the protocol to ULTRA or VLESS brings the speed back right away.
- The problem happens with one carrier and not another.
The fix is to switch protocols in the app. For more on how this works and why a protocol that worked yesterday is slower today, see the section on VPNs in Russia.
MTU and DNS
MTU: when everything “works” but is slow
MTU is the largest packet size along the route. Regular Ethernet is 1500 bytes; a tunnel adds headers, so inside it a packet needs to be smaller — typically 1420 for WireGuard, and even smaller on mobile carriers and PPPoE. If the MTU inside the tunnel is bigger than the route allows, packets get fragmented or dropped. The symptoms are distinctive: small pages load fine, large files and video stall, and speed fluctuates.
The app picks the MTU automatically, but on networks with non-standard encapsulation (some mobile carriers, satellite internet, nested tunnels) reducing it manually to 1280–1380 in the connection settings helps.
DNS: a slow start for every page
If DNS queries go to a distant or overloaded server, every new page starts with a pause even though the loading speed itself is normal. The app routes DNS through the tunnel to a resolver near your server. If you’ve set a DNS server manually in the system, check that it isn’t on another continent relative to your VPN location.
Wi-Fi, the device’s processor and the router
2.4 or 5 GHz Wi-Fi
The 2.4 GHz band is crowded with neighbours and microwaves, and its practical ceiling is 30–60 Mbit/s with high packet loss. A VPN is more sensitive to loss than ordinary traffic, because a lost tunnel packet is lost data from several connections at once. Connect to a 5 GHz network or a cable and measure again — the diagnosis often ends right there.
The device’s processor
Encryption happens on the device. A modern phone or laptop handles hundreds of megabits with no trouble, but an old tablet, TV or router can hit its processor’s ceiling. The tell-tale sign: speed is equally low regardless of location, and the device gets warm. A protocol with light encryption — WireGuard or MeduzaVPN — helps.
VPN on a router
If the VPN runs on a router, the limit is its processor. On MT7621 the ceiling is tens of megabits; on Filogic and x86, hundreds. That’s normal and isn’t fixed by switching location — for devices that need full speed, install the app directly on them.
Server load
On mass-market VPN services, thousands of users share one server, and in the evening, when everyone is watching video, speed drops for everyone. That isn’t fixed by the protocol or MTU — only by switching to a server that has fewer people on it at the moment.
A MeduzaVPN personal server doesn’t have this problem: it’s just you and your family on it, the channel isn’t shared with strangers. So if speed drops, look among the other causes in this article instead. The difference between the two models is covered in the article on the personal VPN server.
The only “server-side” factor for a personal VPN is the data centre’s connectivity to your ISP. If the geographically closest location performs worse than a farther one, the cause is the route, and the fix is to try a neighbouring location.
Split tunneling for heavy apps
Not all traffic needs a VPN. Tens of gigabytes of game updates, cloud backups, and domestic services that refuse foreign IPs anyway — all of these can be taken out of the tunnel. Split tunneling in the MeduzaVPN app lets you choose apps that go direct and keep only what you turned the tunnel on for inside it.
What people usually take out of the tunnel:
- game stores and update clients;
- cloud storage with large syncs;
- banking apps and government services;
- local streaming services that don’t work with a foreign IP;
- torrent clients, if they aren’t the reason for the VPN.
The trade-off: traffic from excluded apps is visible to the ISP and goes out on your real IP. Exclude only what that’s acceptable for.
Conclusion
The order to diagnose in: measure correctly, pick the closest location, use WireGuard or MeduzaVPN on a clean network and ULTRA on a filtered one, check 5 GHz Wi-Fi and the MTU, and move heavy apps into split tunneling. In most cases, after that the VPN lags a direct connection by only a few percent.
A MeduzaVPN personal server removes the main cause of a slow shared VPN — someone else’s load — and switching protocols in the app deals with carrier filtering. Subscriptions come with 7 days free so you can check the speed on your own network. See plans.
FAQ
How much does a VPN usually slow things down?
With a nearby location and a modern protocol, the loss is 5–15% of the speed without a VPN, and latency rises by 10–40 ms. If the drop is more than double, the cause is almost always specific: a distant location, filtering by the ISP, an overloaded shared server, or weak Wi-Fi.
Which protocol is fastest?
On a clean network — WireGuard and MeduzaVPN: they have minimal overhead and efficient encryption. MeduzaVPN ULTRA is close to them but adds disguising that slightly increases overhead. OpenVPN is noticeably slower because of its older architecture, especially on weaker devices.
Why is the VPN fast at home and slow on mobile data?
Mobile carriers run traffic-analysis equipment that can recognise and throttle specific protocols. Home ISPs can do the same, just less often. Switching to a disguised protocol — ULTRA or VLESS — usually brings the speed back.
What is MTU and why does it affect speed?
MTU is the largest packet size that passes along a route without being split. A VPN adds headers to every packet, and if the MTU inside the tunnel isn’t reduced, packets get fragmented or dropped, and speed falls even though the connection looks fine. The app picks the MTU automatically, but on networks with non-standard settings, reducing it manually helps.
Can an overloaded server be the cause?
For shared VPNs, yes — it’s one of the main reasons: thousands of users share one node’s bandwidth. A MeduzaVPN personal server doesn’t have this problem, because it’s only you on it. If speed is still low, look at the location, the protocol or the home network instead.
How do you measure VPN speed correctly?
Measure speed with the VPN off and on, on the same device, on the same network, a minute apart, against the same test server. Repeat three times and compare the medians. A single measurement at a random time of day tells you nothing.
Do you need to route all traffic through the VPN?
Not necessarily. Split tunneling lets you take heavy apps that don’t need the VPN out of the tunnel: game updates, cloud backups, local services. That frees up the tunnel and keeps the speed for whatever you turned the VPN on for.