Sizing a VPS for a team VPN: how many concurrent users per plan

You have a team of twelve people in offices across Guangdong, Shenzhen, and Hanoi. Everyone needs access to the same server in Vietnam, a shared database, a staging environment, an internal tool. You decide to run a WireGuard VPN on a VPS. The question is: how much RAM does the VPS need?

Run too small and the kernel runs out of memory for packet buffers, connections drop, latency spikes, users complain. Run too large and you are paying for resources the VPN never touches. This post sizes a WireGuard-based team VPN for real concurrent usage: what a peer costs in RAM and CPU, when the bottleneck shifts from CPU to network, and which VPS plan matches which team size.

All figures are approximate, they come from a test setup with Ubuntu 24.04, WireGuard v1.0.20220627, and the default kernel configuration. Your mileage depends on kernel version, encryption offload, and how much traffic each peer actually pushes.

为十人团队配置 WireGuard VPN，2GB 内存的 VPS 可稳定支持 20 to 30 个并发用户。

A 2 GB RAM VPS can stably support 20 to 30 concurrent peers in a WireGuard team VPN setup.

Prerequisites

• A VPS running Ubuntu 24.04 LTS or Debian 12.
• Root access or a user with sudo.
• A dedicated IPv4 from the Vietnam range, WireGuard binds to a single IP and needs it stable.
• UDP port 51820 open on the VPS firewall (nftables or ufw).
• The WireGuard package installed: apt install wireguard.

Why a team VPN needs its own VPS

A shared workplace or a SaaS VPN provider works fine for occasional access. But for a cross-border team split between China and Vietnam, say developers in Guangzhou connecting to a GitLab instance in Hanoi, a dedicated VPN VPS gives you control: your own routing, your own DNS, no shared IP that gets flagged, and no bandwidth throttled by a third-party dashboard.

A Vietnam VPS with a local IPv4 means the tunnel endpoint sits inside the domestic network of Viettel, VNPT, FPT Telecom, or CMC Telecom, whichever datacenter the VPS provider uses. Traffic between the VPS and any Vietnam-hosted service stays on domestic links (100 Mbps by default on a 1 Gbps port). Traffic from China enters the international pool, which is a shared resource of roughly 4 to 10 Mbps. That asymmetric bandwidth profile is important for the sizing: the VPS itself can push plenty of data inside Vietnam, but the China-to-Vietnam leg is the real bottleneck.

If your team is running WireGuard on a Windows VPS with RDP, the RAM question changes slightly, Windows Server itself needs 1.5 to 2 GB before WireGuard runs. Linux is leaner. This article sizes for Linux; for Windows, add 2 GB to every number.

What a WireGuard peer costs in practice

WireGuard is famously light. An idle peer, one that has a handshake but passes zero traffic, consumes almost no CPU and roughly 8 to 16 MB of kernel memory for its data structures (peer state, crypto keys, allowed IPs). The precise number depends on how many allowed IPs you configure. One allowed IP per peer is the norm for a simple tunnel; a hundred pushes it toward 32 MB per peer.

Once traffic starts flowing, the cost shifts to packet processing:

• CPU per peer: around 0.3 to 0.5% of a single vCPU core per megabit of throughput, measured with ChaCha20Poly1305 encryption (WireGuard's default). A VPS with a modern x86 vCPU handles 1 Gbps of WireGuard traffic using about 30 to 40% of one core. For a team of 30 people each pushing 1 Mbps, that is roughly 30 Mbps total, about 10 to 15% of one vCPU. CPU is almost never the bottleneck.
• RAM per peer: 8 to 16 MB at idle, 32 to 64 MB under active load (packet buffers, socket buffers, kernel slab caches). A rule of thumb that holds in testing: 1 GB of available RAM supports 30 to 50 concurrent WireGuard peers.
• Network per peer: the real ceiling. Domestic bandwidth on the VPS is 100 Mbps. If all 30 peers are downloading 5 Mbps each from a Vietnam-hosted resource, that is 150 Mbps, above the 100 Mbps domestic cap. The international leg (4 to 10 Mbps shared) is even tighter. For a China to Vietnam VPS scenario, the international pool is what every peer leaving Vietnam shares.

The practical limit is almost always network throughput, not CPU or RAM. For a team using the VPN primarily to reach services inside Vietnam (databases, internal sites, staging servers), domestic bandwidth is the number to watch. For a team that routes general internet traffic through Vietnam (rare and not recommended for latency-sensitive work), the international pool is the limiter.

Tier 1 to 2 GB RAM: 10 to 15 concurrent users

A 2 GB VPS on Ubuntu 24.04 uses roughly 400 MB at boot. After WireGuard starts and you add 10-15 peers, the kernel is using another 200-300 MB for crypto and packet buffers. That leaves about 1.2 GB free, enough for the VPN to run without swapping.

With 10 to 15 concurrent users each transferring 2 to 3 Mbps (typical for development work, SSH, git push, a few API calls), the total traffic is 20 to 45 Mbps. That fits comfortably inside the 100 Mbps domestic ceiling. For the international leg, 10 users sharing 4 to 10 Mbps means each gets roughly 0.4 to 1 Mbps, acceptable for terminal-based workflows and light web traffic.

This tier fits a small cross-border China Vietnam team: say a few developers in Guangzhou and a project manager in Ho Chi Minh City, all connecting to a shared Postgres instance in Hanoi.

Tier 2 to 4 GB RAM: 20 to 30 concurrent users

A 4 GB VPS has room for overhead. After the OS and WireGuard take about 1 GB, you have roughly 3 GB for peer buffers. At 64 MB per actively transferring peer, that works out to 48 peers before pure RAM becomes a problem. The practical cap is lower because of the network ceiling.

Twenty to thirty concurrent users each pushing 3 Mbps means 60 to 90 Mbps total, nearing the 100 Mbps domestic cap but not yet hitting it. If most traffic is internal Vietnam-to-Vietnam, the VPS handles it. If half the users are connecting from China (Yunnan, Guangxi, Shenzhen), their traffic passes through the shared international pool, and the per-user throughput drops to roughly 0.2 to 0.5 Mbps.

This is the sweet spot for a Vietnam VPS for China business scenario: a team of 25, half in Guangdong and half in Hanoi, sharing a code repository and a CI/CD runner. The VPN stays stable, the RAM never runs out, and the bottleneck is the international link, not the server.

Tier 3 to 8 GB RAM: 50 to 70 concurrent users

At 8 GB you are no longer RAM-constrained. The OS and WireGuard use about 1.2 GB. The remaining 6.8 GB supports 100+ peers from a kernel memory perspective. The bottleneck is now purely network.

With 50 to 70 concurrent users, even if each averages only 1 Mbps, total traffic is 50 to 70 Mbps, still inside the 100 Mbps domestic cap but close. If traffic patterns spike (e.g., a large git clone or a database restore), the domestic link saturates. The international pool becomes a shared resource that 70 users must split, giving each roughly 0.06 to 0.14 Mbps, enough for chat and email, not much else.

For this scale, consider splitting the load: run the VPN VPS for management and inside-Vietnam traffic, and put public-facing services behind a separate reverse proxy so the VPN doesn't carry every byte of user-facing content.

If you prefer a Windows VPS with RDP as the always-on desktop for the team, note that Windows Server itself eats 2 GB RAM at idle. An 8 GB Windows VPS leaves about 5.5 GB for WireGuard and buffers, still enough for 50 peers, but the per-peer memory headroom is lower.

Tier 4 to 16 GB RAM: 100+ concurrent users

At this size, the WireGuard kernel module can handle 200+ peers without breaking a sweat. The 16 GB VPS is overkill for the VPN itself; you are buying this capacity because the VPS also runs other services (a GitLab instance, a CI runner, an internal Wiki). WireGuard steals a fraction of that memory.

The network cap remains unchanged: 100 Mbps domestic, 4 to 10 Mbps international. 100 users each sending 1 Mbps would need 100 Mbps, the domestic link is saturated at exactly the ceiling. In practice, not every user is active at once, and the total sustained throughput for a 100-person team VPN is usually below 50 Mbps.

Network bottlenecks: the real ceiling

No matter how much RAM you throw at it, a WireGuard VPN cannot push more than 100 Mbps domestically or roughly 4 to 10 Mbps out of Vietnam. These are the limits of the VPS port itself, not the software. For a VPS for Chinese users connecting to resources inside Vietnam, the international pool is the only path traffic takes. The numbers are shared across all users on the same VPS, if one peer runs a large transfer, the others feel it.

A practical workaround: if your cross-border team needs higher throughput, host a second WireGuard instance on a VPS closer to the Chinese users (Hong Kong or Singapore) and tunnel only the essential traffic back to Vietnam. That keeps the latency-sensitive payload off the long international leg.

Conclusion

The VPN itself is lightweight. A 2 GB RAM VPS comfortably supports a team of 10 to 15. A 4 GB VPS handles 20 to 30. An 8 GB VPS manages 50 to 70, and the 16 GB tier is only necessary if the VPS runs other services. The network ceiling, 100 Mbps domestic, roughly 4 to 10 Mbps international, is what caps the user count, not the kernel memory.

Start with the smallest plan that fits your headcount, monitor iftop and free -h for the first two weeks, and scale up only if you see persistent memory pressure or packet drops. The pricing page lists the exact plans, VNLite (2 GB), VNx1 (4 GB), VNx2 (8 GB), VNx4 (16 GB), so you can pick the nearest match and adjust later.

FAQ

Related articles

• Set up a WireGuard VPN on your VPS in 10 minutes
• Hardening SSH on a new VPS, keys, ports, fail2ban, and CrowdSec
• Why a Vietnam IPv4 matters when your users are in Vietnam
• Vietnam VPS vs. Singapore VPS for serving Vietnamese users