iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
Yes—you can host both on one VPS, but an ordinary HTTPS server and an independent OpenVPN TCP server cannot both listen on the same IP address and TCP port 443. The dependable design is to keep HTTPS on TCP 443 and run OpenVPN on UDP 1194. If clients must reach OpenVPN through TCP 443, use OpenVPN Access Server’s service-forwarding arrangement or a carefully designed protocol-aware front end instead of trying to bind two processes to the same socket.
The port rule that determines the design
A listening socket is identified by an IP address, transport protocol, and port. On one VPS, only one process can normally own a given TCP endpoint such as 203.0.113.10:443. Therefore, Nginx (or Apache) cannot listen directly on TCP 443 while a separate OpenVPN TCP daemon also listens directly on that same address and port. The second process will fail to start with an address-in-use error, or the service that started first will receive all connections.
TCP and UDP are separate protocol namespaces. A TCP service on 443 and a UDP service on 443 can coexist technically, but using the conventional OpenVPN UDP 1194 port makes the configuration easier to understand, document, and firewall. The key distinction is not the number 443 itself; it is whether the two services are competing for the same TCP socket.
Three workable layouts
| Layout | Public listeners | Best use | Main trade-off |
|---|---|---|---|
| A. Separate protocol and port | Website: TCP 443; OpenVPN: UDP 1194 | Most installations and any deployment where the network permits UDP | VPN users on highly restrictive networks may need another transport |
| B. Access Server service forwarding | Access Server TCP daemon: TCP 443; Access Server web services: TCP 943 by default | When VPN clients must connect over TCP 443 and the product’s forwarding feature is acceptable | Forwarding, certificates, and profile reachability must be maintained together |
| C. Protocol-aware front end | One front-end process owns TCP 443 and routes traffic to backends | Specialized environments with an operator who can validate TLS/SNI and OpenVPN handling | Implementation is deployment-specific; a normal HTTPS reverse proxy is not automatically an OpenVPN proxy |
For a general-purpose VPS, choose Layout A first. OpenVPN documentation states that OpenVPN works best over UDP. TCP 443 is a compatibility fallback because restrictive networks commonly permit it, not a performance upgrade.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Layout A: HTTPS on TCP 443 and OpenVPN on UDP 1194
What the finished topology looks like
- TCP 80: optional HTTP endpoint for redirects or certificate validation.
- TCP 443: Nginx or Apache terminates TLS and serves the website.
- UDP 1194: the OpenVPN server accepts VPN tunnels.
- 943 or another web-management port: keep administrative interfaces private or restricted unless they are genuinely required.
Because the website and VPN use different protocol/port combinations, neither service needs to impersonate the other. HTTPS certificates stay with the web server, and OpenVPN client profiles point to the VPN hostname and UDP port.
Prerequisites
- A public IPv4 or IPv6 address that clients can reach, plus a DNS name. OpenVPN recommends using an FQDN for the server identity; an example is
vpn.example.net. - Root or administrator access to install services, edit listeners, protect private keys, and change the VPS firewall and cloud security group.
- A certificate and private key for the website hostname. The key must remain readable by the Nginx master process while being protected from ordinary users.
- A plan for the VPN address pool, authentication, and client-profile distribution. Those details are independent of the website but must be reflected in each profile.
Step 1: Point DNS at the VPS
Create an A record for the website hostname and, if appropriate, an AAAA record for IPv6. You can use separate names such as www.example.net and vpn.example.net, or use one name when your certificate and client policy support it. Do not publish a hostname that resolves to an address where the selected listeners are not actually configured.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 2: Configure the HTTPS listener
In Nginx, the HTTPS server block must enable SSL on the listening socket and specify the certificate and private-key paths. The essential shape is:
server {
listen 443 ssl;
server_name www.example.net;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
root /var/www/example;
index index.html;
}Use the equivalent Apache virtual-host configuration if Apache is your web server. Replace the example hostname and paths with real values; the code above is illustrative, not a certificate-management procedure. After changing the configuration, run the web server’s syntax check, reload it, and confirm that the certificate presented for the requested hostname is the one you intended.
Step 3: Configure OpenVPN for UDP
Set the OpenVPN server to use UDP and port 1194 (or another unused UDP port that you document). The client profiles must contain the public hostname or address, the selected protocol, and the selected port. If you change any of those values later, old profiles may continue trying the former endpoint and appear to be broken.
Do not configure a separate OpenVPN TCP daemon on TCP 443 merely because the website already uses it. That creates the socket collision this layout is designed to avoid. If UDP is blocked for a particular group of users, handle that requirement with a second, deliberately planned transport rather than silently replacing the working UDP service.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Step 4: Open only the required firewall paths
Apply the same policy in the VPS operating-system firewall and the provider’s security group:
- Allow TCP 443 from the Internet for HTTPS.
- Allow TCP 80 only if you use HTTP redirects or an ACME HTTP challenge.
- Allow UDP 1194 from the networks that should be able to establish VPN sessions.
- Restrict administrative SSH, OpenVPN management, and web-management ports to administrator addresses or a management network.
For a host using UFW, the commands will resemble ufw allow 443/tcp, ufw allow 1194/udp, and, only when needed, ufw allow 80/tcp. The exact firewall syntax differs by distribution; the important point is that the protocol is part of every rule. Opening TCP 1194 does not open UDP 1194.
Step 5: Verify ownership before testing clients
On Linux, inspect listeners with:
ss -ltnupYou should see the web server bound to TCP 443 and OpenVPN bound to UDP 1194. If a process is already using the intended endpoint, identify it before changing anything. Starting a second daemon without checking can take down the service that was working.
Test in this order:
- Resolve the website and VPN hostnames from a client network.
- Open the HTTPS site and inspect the certificate and hostname.
- Connect with a newly generated OpenVPN profile over UDP.
- Check server and firewall logs for rejected packets or authentication errors.
- If TCP fallback is part of your plan, test from a restrictive network rather than assuming that an open-looking firewall rule proves it works.
Layout B: Use OpenVPN Access Server service forwarding on TCP 443
OpenVPN Access Server provides a product-specific way to let its TCP daemon own port 443 while forwarding browser requests to web services. Access Server web services commonly listen on TCP 943 by default. In this design, a browser connects to the Access Server process on 443; the service recognizes the browser request and forwards it internally to the appropriate web service. This is materially different from asking two independent daemons to bind TCP 443.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →When this layout makes sense
- Your users are behind networks that block UDP and you need OpenVPN’s TCP 443 fallback.
- You are using Access Server rather than only the community OpenVPN server.
- You can operate and test the forwarding rules, web-service port, certificates, and client profiles as one system.
How the traffic flow works
- The Access Server TCP daemon owns the public TCP 443 socket.
- OpenVPN clients use that endpoint for the TCP VPN transport.
- Browser traffic arriving at the same endpoint is recognized by the forwarding mechanism.
- Access Server sends browser requests to its web services, commonly on TCP 943, or to a configured local Apache or Nginx service according to the forwarding design.
The exact menu names and options depend on the Access Server release. Follow the service-forwarding configuration for that release and record the current web-service port before making changes. A forwarding rule that points to the wrong local port can make the login page disappear even though the VPN daemon itself is healthy.
Protect the management path while forwarding
Before disabling forwarding, changing daemon interfaces, or moving the web service, verify that both the client web UI and server-locked client profiles remain reachable. Keep an existing administrative session open while applying the change, and have a console or out-of-band recovery path in case the web interface becomes unreachable.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Decide which process terminates TLS. If Access Server presents the public certificate on 443 and forwards an already established web request, its certificate and hostname settings are the ones clients see. If the forwarding design passes HTTPS to Nginx or Apache for TLS termination, the backend certificate and key paths must match the requested hostname. Do not install a certificate in one process and assume the other process will present it.
Forwarding to an existing website
Access Server’s forwarding documentation also describes forwarding browser traffic to an Apache2 or Nginx service through port 443 with a custom local redirection. Treat that as a controlled migration:
Recommended Free Tools
- Document the current Access Server web-service port and the current website listener.
- Choose an unused local backend port for the website if the forwarding design requires one.
- Configure the website to listen on that local port and verify it locally first.
- Configure service forwarding to that backend, preserving the VPN daemon’s ownership of public TCP 443.
- Test the browser UI, an OpenVPN TCP client, and a locked client profile before closing the old path.
Do not copy a generic reverse-proxy recipe into this setup without checking the protocol assumptions. OpenVPN’s TCP stream is not ordinary HTTP, and an HTTP-only proxy cannot route it correctly.
Layout C: A front end that owns TCP 443
A third approach puts one protocol-aware front-end process on the public 443 socket and routes different traffic to backend services. This can be appropriate in a specialized deployment, but it requires deliberate handling of TLS, SNI, connection inspection, and OpenVPN’s protocol. The canonical Access Server forwarding mechanism documents one supported product design; it does not make every Nginx stream configuration safe or equivalent.
Choose this layout only when you can answer all of these questions before deployment:
- Which component accepts the first TCP connection?
- Where is TLS terminated, and which certificate is presented for each hostname?
- How does the front end distinguish browser HTTPS from OpenVPN TCP without corrupting either stream?
- What happens when the front end reloads or fails?
- How will health checks prove that both the website and VPN remain usable?
If any answer is uncertain, use separate TCP/UDP ports or Access Server’s documented forwarding instead.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Why TCP 443 is a fallback, not the default
OpenVPN’s documentation says that OpenVPN works best over UDP. UDP avoids the retransmission and congestion-control layering that occurs when a reliable VPN tunnel is carried inside another reliable TCP stream. When packet loss occurs, both layers can retransmit and wait, producing the TCP-over-TCP “meltdown” behavior documented by OpenVPN. The result is often poor responsiveness rather than a predictable throughput number; no authoritative combined-deployment benchmark establishes a universal speed penalty.
TCP 443 remains valuable because restrictive hotels, offices, and public networks commonly allow outbound HTTPS. Treat it as a compatibility path for users who need it, not as a reason to move every VPN connection away from UDP. If most users can reach UDP 1194, keep that as the primary profile and distribute a TCP 443 profile only to the users or networks that need it.
Certificates, names, and identity
Use the name clients are actually requesting
An HTTPS certificate is valid for specific hostnames. If users browse to www.example.net but the server presents a certificate issued only for vpn.example.net, browsers will warn even when the TCP routing is correct. The same principle applies when a forwarding layer terminates TLS before sending traffic to a backend.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesProtect private keys
NGINX requires the certificate and private-key locations to be specified on the SSL-enabled listening socket. The private key must be readable by the Nginx master process but not broadly readable by unprivileged accounts. Verify file ownership and permissions after renewals; a certificate-renewal job that changes permissions can cause a reload failure.
Keep VPN identity consistent
OpenVPN recommends an FQDN for the server identity. Use that name consistently in client profiles, documentation, certificates where applicable, and monitoring. If you change the hostname, protocol, interface, or port, regenerate or redistribute profiles as required rather than expecting existing profiles to discover the change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting by symptom
The website shows an OpenVPN login page
TCP 443 is probably owned by Access Server, or its service-forwarding rule is sending browser requests to the Access Server web service instead of the website. Inspect the Access Server forwarding configuration and confirm which local port serves the website. Also verify which process presents the certificate. Do not “fix” the symptom by starting another HTTPS daemon on 443; it cannot bind while Access Server owns that socket.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
The web server will not start and reports “address already in use”
Run ss -ltnp and identify the process holding TCP 443. Decide which service should own that endpoint. In Layout A, stop or reconfigure the unintended process and leave Nginx or Apache on 443. In Layout B, leave Access Server on 443 and move the website to the backend port used by forwarding.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →VPN clients stopped working after a port or interface change
Compare the client profile with the server’s current public hostname, protocol, and port. Regenerate or redistribute profiles when those values changed. Check the VPS firewall and provider security group separately; a correct OpenVPN configuration cannot receive packets that the cloud firewall drops.
Browsers report a certificate error
Confirm that the actual TLS terminator owns TCP 443 and that its certificate includes the hostname in the address bar. Check the configured certificate and private-key paths, permissions, intermediate chain, and whether a forwarding layer is presenting a different certificate than the backend web server.
UDP connections fail but TCP works
Check both layers of filtering: the VPS firewall and the provider security group. Ensure the rule is UDP 1194, not TCP 1194, and verify that the client network permits outbound UDP. If the network blocks UDP, use a deliberately configured TCP fallback rather than changing the primary profile without notifying users.
TCP VPN performance is disappointing
Move users back to UDP where the network permits it. TCP-over-TCP behavior can amplify loss and latency. Avoid claiming a fixed speed percentage; the effect depends on congestion, packet loss, and the intervening network.
Free tools Windows power users keep installed
One-click scans. No signup required.
Operational checklist
- Record one owner for every public socket: TCP 80, TCP 443, UDP 1194, and any management port.
- Keep website and VPN DNS names documented and resolve them from an external network.
- Confirm listeners with
ss -ltnupafter every service or port change. - Open only the selected TCP and UDP ports in both host and cloud firewalls.
- Back up Access Server forwarding and web-server configuration before editing listeners.
- Maintain an out-of-band recovery method before changing the only administrative web path.
- Test HTTPS, UDP VPN, and any TCP fallback independently, then test them together from a restrictive network.
- Redistribute client profiles whenever hostname, protocol, interface, or port changes.
- Monitor certificate expiry and reload failures, especially when a forwarding layer terminates TLS.
Choosing the right design
| Requirement | Recommended choice |
|---|---|
| Normal Internet access and maximum simplicity | Nginx or Apache on TCP 443 plus OpenVPN on UDP 1194 |
| Some users can reach only TCP 443 | Keep UDP as the primary transport and add a tested TCP 443 fallback |
| Access Server is already deployed and its web UI must share the public endpoint | Use Access Server service forwarding, with web services commonly on TCP 943 or a documented local backend |
| Custom multi-protocol edge architecture with dedicated operations support | Evaluate a protocol-aware front end; validate TLS and OpenVPN routing before production |
The stable default is straightforward: let the HTTPS server own TCP 443, let OpenVPN use UDP 1194, and keep the firewall and client profiles aligned with those choices. Share TCP 443 only through a forwarding design that explicitly supports both browser traffic and OpenVPN, never by assigning the same socket to two independent services.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
