Single thread
A final, significant item to note is that OpenVPN is single-threaded (inclusive of OpenVPN 2.4). Regardless of how many processors or threads provided by the CPU, OpenVPN will be limited to a single thread. In various tests in recent years, a realistic limit of about 200 client connections is considered the maximum before performance falls off considerably.
It is possible to work around this limitation using load balancing across multiple OpenVPN server instances. These scenarios are more complicated as they require the administrator do additional configuration to ensure the two (or more) instances are able to communicate and clients are able to connect to the appropriate server(s).
The inclusion of AES-NI helps with this single-threading, as the cryptographic operations can be offloaded, speeding up the processing of each packet. On slow systems and those systems that do not include crypto-offloading, performance will be significantly slower.
