I have two Mikrotik routers coupled by a wireless bridge. I want to use an encrypted VPN to carry some sensitive traffic. Which VPN is fastest?

IPSec if you are using any hardware accelerated routerboard (RB1000, RB1100AHx2). Anyway, how much bandwidth do you need? A simple RB450G should give you 15Mbits of AES-128 bandwith

Its for backing up a server so the faster the better. One end is RB1100AH and the other is RB2011L. The connection is 100Mbps.

It's RB1100AH or RB1100AHx2? The later supports HW encryption and manual says you should get ~700Mbps. Anyway, the other end doesn't have HW engine, and based in my experience with RB450G you may expect something around 20Mbps from RB2011

L2TP with RC4?

OVPN with BF128.

Tested OpenVPN -- Backup ran at 6Mbps

Tested IPSEC tunnel -- Backup ran at 30 Mbps. RB2011 showed 100% CPU with AES128

Nice, I was expecting lower performance from RB2011 as it has 600Mhz CPU versus RB450G's 680Ghz.

You may try to fine tune the tunnel playing with MTU/Clear DF so it won't generate unneeded fragmentation and thus less packets to enc/decrypt. Anyway, you probably won't see much more than that.

2011 should be about 20% faster than 450g in my experience.

My experience is that SSTP is fastest for tunneling routerboard-routerboard and routerboard-windows when you're not having rb1100AHx2 or rb1000 on both ends. With those two routerboards ipsec 3des is the fastest. However, rb1100AH (not x2) also won't have any problem filling a 100mbit link with ipsec.

For the routerboards without cryptochip (not rb1000 / rb1100AHx2) AES128 is the fastest kind of ipsec.

I have not tested ipsec on rb2011 thou.

(I'm running a hosting center with ipsec link to all customers.)