I can drive 2+ Gbps vrfs, nats, ipsec, complex firewall rules and several routing tables through an Atom C3558. This is just using stock linux kernel networking. There are other services running on that box too.

Depending on details, it can go higher (e.g. without the ipsec being handled on the atom box, and using the 10G ports built into the chip, offload becomes helpful for TCP and UDP flows).

This is traffic in one 10G port and out the other, in this case. Multiport flows were not tested since they were out of spec for the use case.

This is not a one off - this is a product I built and has been tested in many deployment scenarios. (I can't provide more details due to employment reasons, and I won't name the employer)