Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
For a standard OpenVPN Community server, allow and forward UDP 1194 to the OpenVPN host. If the server is configured for TCP, allow its configured TCP port instead; OpenVPN Access Server commonly provides TCP 443 as a fallback. TCP 943 is normally an Access Server web-service port, not the VPN tunnel listener. The exact rule must match the server configuration, client settings, host firewall, cloud firewall and any router or NAT gateway.
Quick answer: which port should be open?
OpenVPN does not require one universal port in every deployment. The port and transport protocol are configuration choices. The following defaults cover the most common installations:
Recommended Free Tools
| Deployment or purpose | Default listener | What it carries |
|---|---|---|
| OpenVPN Community server | UDP 1194 | VPN tunnel traffic |
| OpenVPN Community server using TCP | The TCP port specified by port |
VPN tunnel traffic |
| OpenVPN Access Server VPN daemon | UDP 1194 and commonly TCP 443 | VPN tunnel traffic over UDP or TCP |
| OpenVPN Access Server web services | TCP 943 in the documented default layout | Admin and Client Web UIs |
OpenVPN’s official documentation identifies UDP 1194 as the default and the IANA-assigned OpenVPN port. It also describes OpenVPN as firewall-friendly because a deployment can use a single UDP port. See the OpenVPN 2.4 manual and OpenVPN 2.7 manual.
How OpenVPN chooses a port and protocol
UDP 1194 is the Community default
A typical Community server configuration creates a routed virtual TUN interface and listens for clients on UDP port 1194. In a basic installation, that means the host firewall needs an inbound UDP rule for destination port 1194, and a router in front of the host must forward UDP 1194 to the server’s private address. The official example configuration is documented in Creating Configuration Files for Server and Clients.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
“Default” does not mean “mandatory.” If you change the server’s port, every network control and client profile must use the new value.
TCP is an alternative, not an additional requirement
Setting proto tcp selects TCP instead of UDP. TCP can help when a network blocks or severely restricts UDP, but the OpenVPN 2.7 documentation cautions that TCP is usually less efficient and less robust on unreliable or congested networks. UDP remains the normal choice when the network permits it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →A server and client must agree on the transport. A client profile using proto udp and port 1194 will not connect to a listener configured for TCP on port 443. Running both transports requires two separate OpenVPN server instances, each with its own protocol and listener configuration; one instance cannot simultaneously treat the same listener as both UDP and TCP.
Any port from 1 through 65535 can be configured
The OpenVPN Community getting-started documentation states that any port from 1 through 65535 can work. If no port is specified, OpenVPN uses 1194. A custom port can therefore be useful when it fits an existing firewall policy, but changing it does not remove the need to open the correct protocol and to update every client profile. The setting is a coordination point, not a security boundary.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Community OpenVPN: the exact settings to align
For a Community deployment, check the server configuration before creating firewall rules. The relevant values are the protocol and port, commonly represented by directives such as:
proto udp
port 1194If you deliberately choose TCP, the corresponding configuration might be:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsproto tcp
port 443The examples show the relationship between the settings; use the values actually present in your configuration. The client profile must point to the same public hostname or address, protocol and port in its remote and protocol settings.
Permit the listener on the host firewall
On a Linux host using iptables, the official manual documents an inbound rule for UDP 1194:
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
iptables -A INPUT -p udp --dport 1194 -j ACCEPTApply the equivalent rule in whatever firewall manager your operating system uses. For a custom listener, replace both the protocol and port with the configured values. A rule for TCP 1194 does not permit UDP 1194, and a rule for UDP 443 does not permit TCP 443.
Also check that the OpenVPN process is actually listening on that address and port. A host firewall rule can be correct while the daemon is stopped, bound only to a different interface, or configured for another port.
OpenVPN Access Server: tunnel ports versus web ports
Access Server separates VPN daemon listeners from its web services. Its documented default layout commonly includes UDP 1194 and TCP 443 for VPN connections. Both are configurable in the daemon settings. TCP 443 is commonly offered as a fallback because many simpler firewalls allow traffic that resembles ordinary HTTPS.
| Access Server port | Role | When to expose it |
|---|---|---|
| UDP 1194 | VPN daemon listener | When clients use the default UDP tunnel |
| TCP 443 | VPN daemon listener and TCP fallback | When clients need TCP or the deployment enables that listener |
| TCP 943 | Admin and Client Web UIs | When browser-based administration or client-portal access is required |
Do not describe TCP 943 as the required OpenVPN tunnel port. It is a web-service port in the documented default arrangement. If users only need a VPN tunnel and not browser access, opening 943 is not automatically necessary. If web access is needed, restrict administrative exposure to trusted source ranges where your environment allows it. The port roles are detailed in the Access Server daemon ports tutorial and Access Server web-service ports tutorial.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
What to forward on a router or NAT gateway
If the OpenVPN host has a public address directly on its interface, there may be no port-forwarding step. If it uses a private address behind a router, cloud NAT gateway or perimeter firewall, opening the host firewall alone is insufficient. The edge device must translate the public listener to the internal server.
- Find the public listener. Confirm the server’s
protoandport, such as UDP 1194 or TCP 443. - Reserve the server’s internal address. Use a static address or a DHCP reservation so the forwarding target does not change.
- Create the forwarding rule. Forward the same external protocol and port to the OpenVPN host’s internal address and listener port. For example, forward public UDP 1194 to private UDP 1194.
- Allow the traffic at the edge. A router ACL, perimeter firewall or managed NAT policy can still block a port-forward even when the translation exists.
- Allow the listener on the host. Add the matching operating-system firewall rule.
- Align the client profile. The client’s server name, protocol and port must identify the public endpoint, not an inaccessible private address.
- Test from outside the local network. Testing from inside the same LAN can be distorted by routers that do not support NAT loopback.
OpenVPN’s VPN Server Behind Firewall guide covers the forwarding requirement. In a cloud deployment, perform the same alignment with the provider’s security group, network ACL and any load balancer or gateway in front of the host.
UDP versus TCP: which should you use?
| Choice | Advantages | Trade-offs and requirements |
|---|---|---|
| UDP | OpenVPN’s default; efficient for interactive VPN traffic; usually the preferred transport | Must be permitted by the network; commonly uses UDP 1194 |
| TCP | Can work on networks where UDP is blocked; Access Server commonly offers TCP 443 as fallback | Usually less efficient and less robust on unreliable or congested networks; requires TCP on both client and server |
| Custom port | Fits a local policy or avoids a conflicting service | Must be opened and forwarded consistently; every client profile must use the custom value |
Choose UDP 1194 for a normal Community installation unless a documented network constraint requires another option. Choose TCP only for a specific compatibility reason, then configure and test it as a separate listener. Do not assume that selecting port 443 makes a UDP tunnel equivalent to HTTPS; the protocol still matters, and a TCP listener is the one that uses TCP 443.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Cloud and enterprise firewall checklist
Port exposure is a chain of controls. A connection succeeds only when each relevant layer permits the same protocol and destination:
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
- OpenVPN configuration: the daemon is bound to the intended protocol, port and interface.
- Operating-system firewall: inbound traffic for that exact protocol and port is allowed.
- Cloud security group or network firewall: the rule allows the public source ranges and listener port.
- NAT or perimeter gateway: traffic is translated to the correct internal address when the server is private.
- Routing: return traffic has a valid path back to the client.
- Client profile: the remote endpoint, protocol and port match the public listener.
Keep the source range as narrow as practical for management and web-service ports. A tunnel listener normally must be reachable by the clients you intend to support, but TCP 943 should not be exposed broadly merely because the VPN itself is reachable.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCommon symptoms and fixes
The client times out immediately
Verify that the public address resolves correctly, the router forwards the listener, and the cloud or perimeter firewall permits the exact protocol. A UDP rule will not satisfy a TCP client. Confirm that the OpenVPN process is running and listening on the expected port.
The server works locally but not over the internet
This usually indicates a missing NAT rule, an incorrect internal target, an upstream firewall block or a provider-level restriction. Test from a genuinely external network and inspect logs on both the gateway and the OpenVPN host.
The client reaches the server but negotiation fails
Compare the client profile with the server’s proto and port values. Also check that the client is using the public endpoint and that a second service has not claimed the configured port.
TCP 943 was opened, but the VPN still cannot connect
TCP 943 serves Access Server’s web interfaces in the documented layout. Check the VPN daemon listener instead: normally UDP 1194 or TCP 443, unless those values were changed in the Access Server configuration.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →UDP is blocked on the user’s network
Enable and configure a TCP listener, commonly TCP 443 on Access Server, and distribute a client profile that selects TCP and that port. This is a separate listener; enabling it does not automatically convert the existing UDP service.
Before opening a port, verify these values
- Which OpenVPN edition is installed: Community or Access Server?
- Which protocol does the active daemon use: UDP or TCP?
- Which port is configured, and is another service already using it?
- Is the host directly public, or is a router, NAT gateway or load balancer in front of it?
- Do the host firewall and every cloud or perimeter firewall allow the same protocol and port?
- Does the client profile’s
remoteendpoint and protocol match the public listener? - If Access Server web access is required, is TCP 943 exposed only to the users and administrators who need it?
Once these values agree, the standard Community answer is straightforward: permit and forward UDP 1194. Treat TCP 443 and TCP 943 as separate, purpose-specific choices rather than interchangeable OpenVPN ports.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
