32ms across IPsec? If so it sounds like you're getting right about what you should for a single-stream TCP session with 32ms latency and a 128KB buffer. That is probably a little high since you have the 30Mbit upstream at one end and certainly not a 1460 MSS across IPsec. Bandwidth-delay Product and buffer size BDP (1000 Mbit/sec, 32.0 ms) = 4.00 MByte required tcp buffer to reach 1000 Mbps with RTT of 32.0 ms >= 3906.2 KByte maximum throughput with a TCP window of 128 KByte and RTT of 32.0 ms <= **32.77 Mbit/sec.** You could try giving a -P4 or -P8 to the iperf client to see if running multiple streams helps. Or switch to UDP and see how high you can take the -b parameter before you start experiencing loss.