One exit node is easy to specify and tells you nothing about the next fifty. Concurrency, throughput per session and oversubscription set subscribers per node; packet rate rather than cipher choice sets the ceiling; and country coverage wants a tiered fleet, not identical boxes.
Buying servers for a VPN provider is a fleet problem, not a server problem. One exit node is easy to specify and tells you almost nothing about what the next fifty cost. The numbers that decide a VPN business are subscribers per node, the oversubscription ratio you are willing to run, and how many countries you must appear in — and those three interact in ways that make the cheapest per-node price frequently the wrong buy.
The chain is short and each link is measurable.
Concurrency. Not every subscriber is connected. Consumer VPN concurrency typically runs 10–25% at peak; business VPN runs far higher because the tunnel is always up. Measure yours; assume 20% only until you have data.
Throughput per active session. This is where estimates go wrong. Average sustained use per connected session is low — often 0.5 to 2 Mbps, because most sessions are idle most of the time. What you must survive is the tail: a small share of sessions streaming or downloading at 20–100 Mbps each.
Work an example. A 10 Gbps guaranteed node, 20% concurrency, 1.5 Mbps average per active session:
10,000 Mbps ÷ 1.5 Mbps = 6,600 concurrent sessions
6,600 ÷ 0.20 concurrency = 33,000 subscribers
Then apply headroom. Run at 60% of theoretical capacity and it is closer to 20,000 subscribers per 10 Gbps node. Push past 80% and the tail sessions start colliding, which subscribers experience as "the VPN is slow tonight" — the complaint that drives churn.
At €659 for a 10 Gbps build, 20,000 subscribers is about €0.033 per subscriber per month in server cost. That number is the one to carry into pricing discussions, and it is the reason capacity planning is a margin question rather than an engineering one.
Bandwidth is not usually what caps an exit node. Encryption and packet forwarding are, and they cap on the wrong axis.
ChaCha20-Poly1305 and AES-GCM both run fast on modern cores with hardware acceleration — several gigabits per core. The problem is that a VPN's load is small packets, not large ones, and per-packet overhead dominates. A node pushing 10 Gbps of 1,400-byte packets handles about 900,000 packets per second, and at that rate interrupt handling, connection tracking and the userspace-kernel boundary matter more than the cipher.
Three practical consequences:
nf_conntrack_max defaults far below what thousands of NAT'd subscribers need, and the table filling up looks like random connection failures. Size it deliberately and watch nf_conntrack_count.VPN exit node hosting covers the MTU and MSS clamping details that cause the other classic support ticket — the tunnel connects, and some sites never load.
A VPN provider's largest operational risk is not capacity. It is that the addresses your subscribers exit from get blocked, and blocklists act on whole ranges rather than single addresses.
Three approaches, in increasing order of control:
Whichever you choose, the operational rule is the same: an abuse process that responds in hours, not days. Ranges get delisted when the operator is responsive and stay listed when they are not.
Country coverage sells subscriptions; utilisation pays for them. Those goals fight, and most providers resolve it wrong by buying identical nodes everywhere.
The pattern that works is tiered:
| Tier | Where | Build |
|---|---|---|
| Core | Your 5–8 highest-demand countries | Bare metal, 10 Gbps guaranteed |
| Secondary | Moderate demand | Bare metal, 1–2 Gbps guaranteed |
| Coverage | The long tail on your marketing page | VPS, 1 Gbps guaranteed |
A coverage node at €29 that carries 200 concurrent sessions is doing its job — it exists so the country appears in your app. Buying a €659 machine for that country is a pure loss, and buying a €29 one for a core market is churn.
The other half of footprint is path quality rather than presence. A subscriber in Warsaw exiting in Frankfurt cares about the route between them; a node with a short, stable path outperforms a closer node behind congested transit. That is a network question, not a hardware one, and worth testing with real traffic before you commit a region.
nf_conntrack_max, file descriptors and somaxconn raised before launch, not after.How many subscribers can one exit node hold? Roughly 20,000 on a 10 Gbps node at 20% concurrency and 1.5 Mbps average, run at 60% capacity. Every one of those inputs is specific to your subscriber base — re-derive it from your own data rather than adopting the figure.
Bare metal or VPS for exit nodes? Bare metal for core markets where throughput and packet rate matter. VPS for coverage markets where presence matters more than capacity. Mixing them deliberately is the cost-efficient answer, and the servers for VPN range is built to be mixed.
Does the cipher choice affect how many servers I need? Less than packet size does. Modern ciphers are fast; per-packet overhead is what caps a node. Optimise the packet path — kernel WireGuard, multi-queue NICs, sane conntrack — before buying more cores.
What happens when an IP range gets blocklisted? You need a range you control and an abuse process that answers quickly. Providers who respond within hours get delisted; those who do not accumulate blocks until the range is worthless.
How do I plan for growth without overbuying? Buy core-market capacity at 60% utilisation and add nodes when sustained peak crosses 70%. That leaves a full provisioning cycle of margin — send us your concurrency numbers and we will map the fleet.
No one can quote a player count without knowing the title, but the shape of the limit is knowable. The tick deadline binds first, memory decides instances per box, and bandwidth binds the fleet rather than the instance. Each has arithmetic you can run on your own numbers.
A shared slot and a dedicated node can cost the same per terabyte and behave nothing alike. Contended random IO, fair-use ceilings and shared address reputation are what separate them — along with everything a slot simply cannot run.
Monthly transfer is the wrong starting point, because a port is a rate. Size from peak concurrency, per-unit bitrate and headroom — then check the cost per gigabit of each tier, because that curve is not monotonic and the cheapest gigabit is not where most people buy.