LAN side is the problem. I believe I read the HW can pass 2G traffic. The limit is there due to the LAN switch being connected to CPU by a pair of 1G ports. I think with Turris 4.x there was an issue with DSA changes in kernel causing that only one of the pair could be used, but I assume that issue is gone now.