In my tests I was getting around 70MB/s routing with a few dozen firewall rules. However I'm not sure if this was a limit of the APU2, or the devices I was using to generate the traffic.
It also has accelerated crypto, so ipsec/openvpn shouldn't be much slower than routing.