IPsec or OpenVPN for pfSense Site‑to‑Site Tunnels When CPU Is Limited and NAT Traversal Is Required

Goal: Select a site‑to‑site VPN mechanism for two pfSense 2.7.x firewalls that must operate on a CPU with limited AES‑NI support while also needing to traverse existing NAT devices without manual port forwarding.

IPsec benefits from hardware‑accelerated encryption, reducing per‑Mbps CPU load, but its default configuration struggles with symmetric NAT and often requires static port forwards or NAT‑T; OpenVPN runs in user space, consumes more CPU per Mbps, yet its TLS‑based design works through most NATs and offers flexible username/password authentication.

Uncertainty: Under heavy traffic, the pfSense state table timeout values may differ between the ipsec and openvpn processes, potentially affecting connection stability for long‑lived flows.

• Does enabling NAT‑T on IPsec sufficiently mitigate NAT traversal issues without sacrificing its CPU advantage on modest hardware?
• How do the default state table timeout settings for ipsec versus openvpn change when the firewall approaches CPU saturation, and which is more likely to cause premature state expiration?
• In a scenario where CPU usage exceeds 70 %, which VPN type maintains lower latency for real‑time traffic while keeping state table churn minimal?