PORTEncryptedIANA assigned
Port 1194OpenVPN
Port 1194 is the IANA-assigned port for OpenVPN. The server usually listens on UDP 1194, which performs better; TCP 1194 or TCP 443 is used when UDP is blocked by a network. OpenVPN traffic is encrypted with TLS-negotiated keys.
What port 1194 is used for
OpenVPN builds an encrypted tunnel between a client and a server, then routes traffic through it: remote workers into an office network, home users to a self-hosted server, or subscribers to a commercial VPN. Port 1194 is the server's listening port, and the client's side uses an ephemeral port.
OpenVPN multiplexes a TLS control channel (certificates, key exchange) and a data channel (the tunnelled packets) over the same port.
Choosing the transport and port
| Choice | When |
|---|---|
| UDP 1194 | Default; best performance |
| TCP 1194 | UDP blocked but arbitrary TCP allowed |
| TCP 443 | Restrictive networks that allow only web traffic; cannot share the port with a real HTTPS server without a port-share proxy |
WireGuard (UDP 51820) and IPsec (UDP 500/4500) are the other common VPN ports.
Security considerations
- Certificates over passwords. Client certificates issued by your own CA, ideally combined with a username/password or MFA.
tls-authortls-cryptadds an HMAC on the control channel so unauthenticated packets are dropped before the TLS handshake, hiding the server from scanners and blunting floods.- Modern ciphers only: AES-GCM or ChaCha20-Poly1305 for the data channel, TLS 1.2+ for control.
- Limit what the tunnel can reach. A VPN client is inside the network; firewall the VPN subnet like any other.
How to check port 1194
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :1194A line in the LISTENING state means a local program has bound port 1194; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :1194 or lsof -i :1194.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection vpn.example.com -Port 1194TcpTestSucceeded : True means the remote system accepted a TCP connection on port 1194. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
For a UDP server the TCP test above only applies if you also run a TCP listener; otherwise check the client log, which shows the handshake or the timeout.
Firewall considerations
VPN servers need inbound UDP (and/or TCP) 1194 from the internet, which is one of the few cases where an internet-facing rule is appropriate. Clients need no inbound rule.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 1194 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
UDP or TCP for OpenVPN?
UDP. Tunnelling TCP inside TCP causes retransmission interference ("TCP meltdown") and higher latency. Use TCP only on networks that block UDP, and then often on port 443 so the traffic passes restrictive firewalls.
Why does my OpenVPN client connect but nothing works?
The tunnel is up but routing or DNS is wrong. Check the routes pushed by the server, whether the server forwards and NATs traffic, and whether the client is using the VPN's DNS server.