When a Gigabit NIC is capped at 40Mbps, the bottleneck is rarely the physical cable but rather software configurations within the VPN client or operating system. This specific speed limit often indicates that the connection has negotiated at 100Mbps half-duplex or that a tunneling protocol like IKEv2 or WireGuard is mishandling packet fragmentation. Resolving this requires verifying the link speed in the network adapter settings and adjusting the Maximum Transmission Unit (MTU) to prevent packet drops.
Verify Physical Link Negotiation
The first step in diagnosing why your 1000Mbps Network Interface Card (NIC) is performing at 40Mbps is to check the actual negotiated link speed. A common misconception is that a green light on the Ethernet port guarantees Gigabit speeds. In reality, the link may have fallen back to 100Mbps due to faulty cabling, poor crimping, or a defective port on the switch or router. When a connection negotiates at 100Mbps, real-world throughput often hovers around 40-50Mbps due to TCP overhead and retransmissions, which perfectly matches the symptom you are describing.
To verify this on Windows, open the Network Connections panel by pressing
Win + R, typing
ncpa.cpl, and hitting Enter. Right-click your active Ethernet adapter and select Status. Look for the "Speed" field. If it reads 100.0 Mbps instead of 1.0 Gbps, the issue is physical. You should also check the duplex setting; if it shows "Half-Duplex," there is likely interference or a bad cable pair. For Linux users, the command
ethtool eth0 will display the supported and advertised link modes. If the speed is stuck at 100Mbit, try replacing the Ethernet cable with a known Cat5e or Cat6 cable and ensure both ends are securely seated. This step is critical because no amount of software tweaking can overcome a physical layer limitation. If you suspect hardware issues, consider checking related guides on
Ethernet Connection: UDP Packets Lost Upstream but Fine Downstream to rule out broader connectivity faults.
Adjust MTU Settings for VPN Tunnels
If the link speed is confirmed to be 1.0 Gbps, the culprit is almost certainly the Maximum Transmission Unit (MTU). VPNs add encapsulation headers to your data packets, which increases their size. If the original packet plus the VPN header exceeds the MTU of the underlying network path, packets are either dropped or fragmented. Fragmentation severely degrades performance, often capping throughput at roughly 40Mbps depending on the encryption overhead and server load.
You need to reduce the MTU on your VPN interface to accommodate these extra headers. On Windows, you can test the optimal MTU using the
ping command with the
-f (do not fragment) flag and varying packet sizes. Start with a ping to your gateway or a reliable external IP, incrementally reducing the packet size until you find the largest size that does not result in fragmentation. Once identified, apply this new MTU value to your VPN adapter properties in the IPv4 settings. For Linux systems, you can set the MTU directly via
ip link set dev tun0 mtu 1400 (adjusting for your specific interface name). Many modern VPN clients allow you to specify an MTU override in their advanced configuration options, which is often set to 1400 or 1380 bytes for OpenVPN and WireGuard tunnels.
Check VPN Protocol and Encryption Overhead
Different VPN protocols handle traffic efficiency differently. Older protocols like PPTP or L2TP/IPsec introduce significant overhead compared to modern solutions like WireGuard or IKEv2. If you are using a legacy protocol, the CPU might be struggling to encrypt and decrypt packets at high speeds, leading to throttling. Additionally, some VPN providers implement artificial limits or route traffic through congested servers that cannot sustain Gigabit speeds.
Switching to a more efficient protocol can dramatically improve throughput. If your client supports WireGuard, enable it as it is designed for minimal overhead and high performance. If you are stuck with OpenVPN, try switching from UDP to TCP or vice versa, though UDP is generally preferred for speed. It is also worth testing the connection without the VPN enabled to establish a baseline. If the non-VPN speed is close to 1000Mbps, the issue is isolated to the tunnel. Consider looking into routers with native support for efficient protocols if you manage your own infrastructure, as discussed in our guide on
Looking for a Router with Native IKEv2 VPN Support with Username and Password Authentication.
Disable Power Saving Features
Operating systems often include power management features that throttle network interfaces to save energy. These features can cause intermittent slowdowns or cap maximum speeds, especially under heavy load. In Windows, navigate to the Device Manager, locate your Ethernet controller, and open its Properties. Under the Power Management tab, uncheck the option that allows the computer to turn off this device to save power. Similarly, in the Advanced tab, look for settings related to Energy Efficient Ethernet (EEE) or Green Ethernet and disable them. These optimizations can interfere with the full-duplex negotiation required for Gigabit speeds. After making these changes, restart your computer and retest the connection speed. This simple adjustment often resolves unexplained performance drops that persist despite correct cabling and MTU settings.
Frequently Asked Questions
Why does my VPN speed drop only when downloading large files?
Large file downloads require sustained high throughput, exposing any bottlenecks in packet handling or encryption that small tests might miss. If small pings work fine but downloads stall, it is likely due to MTU fragmentation or buffer bloat within the VPN tunnel. Adjusting the MTU to a lower value like 1400 bytes usually resolves this specific behavior.
Can a faulty Ethernet cable cause exactly 40Mbps speeds?
Yes, a damaged cable often forces the NIC to negotiate at 100Mbps half-duplex, which naturally caps real-world TCP throughput around 40-50Mbps. This happens because half-duplex prevents simultaneous sending and receiving, causing collisions and retransmissions. Always replace suspect cables with verified Cat5e or Cat6 standards to rule this out.
Is WireGuard faster than OpenVPN for Gigabit connections?
WireGuard is generally faster because it uses a simpler cryptographic stack and runs in kernel space, reducing CPU overhead. OpenVPN, while secure, adds more layers of encapsulation and context switching that can bottleneck high-speed links. Switching to WireGuard is often the most effective software solution for improving VPN throughput on Gigabit networks.
What should I do if my ISP throttles my VPN traffic?
If your ISP detects and throttles VPN ports, you may need to use obfuscation plugins like Obfsproxy or SwitchyOmega to mask the traffic. Some routers support split tunneling, allowing you to route only specific traffic through the VPN while keeping local LAN traffic direct. This reduces the load on the encrypted tunnel and can bypass ISP-specific limitations.
Does disabling IPv6 help with VPN speed issues?
Sometimes, dual-stack configurations cause routing confusion where VPN traffic attempts to traverse IPv6 paths that lack proper tunnel support. Disabling IPv6 on the VPN adapter forces all traffic through IPv4, which may stabilize the connection and improve speeds if the IPv6 path is unstable. Test this by temporarily turning off IPv6 in the adapter's network settings.