Port 1194 – OpenVPN

TCP/UDP

Port 1194 is the default OpenVPN port. OpenVPN runs over UDP 1194 by default for better performance (no TCP-over-TCP issues) but can use TCP 1194 or TCP 443 to bypass restrictive firewalls. OpenVPN uses TLS for key exchange and a choice of ciphers (AES-256-GCM recommended) for data encryption.

Port Number

1194

Protocol

TCP/UDP

Service

OpenVPN

Range

IANA Registered (1024–49151)

Description

OpenVPN on port 1194 provides full-featured VPN tunneling with TLS-based authentication and configurable encryption. UDP is the default transport because encapsulating VPN traffic in TCP causes performance degradation – retransmissions at both layers compound during packet loss. OpenVPN's flexibility is its strength: it can tunnel over TCP 443 to look like HTTPS traffic, use certificate or username/password authentication, push routes and DNS to clients, and run in site-to-site or remote-access mode. Port 1194/UDP is easily fingerprinted by deep packet inspection – in censorship environments, use obfsproxy or TCP 443 mode. WireGuard on UDP 51820 is the modern alternative with simpler configuration and better performance.

Security risks

1CVE-2023-46850: OpenVPN 2.6.x use-after-free – sending crafted packets to an OpenVPN server causes crash or potential RCE (fixed 2.6.7)
2CVE-2017-7521: OpenVPN server RCE via crafted certificate – unauthenticated attacker sends malformed certificate during TLS handshake causing buffer overflow
3Weak cipher configurations: older OpenVPN configs use BF-CBC (Blowfish, 64-bit block) or DES – vulnerable to Sweet32 attack after ~32GB of traffic
4Static key mode (--secret): shared symmetric key with no forward secrecy – if key is ever leaked, all past and future traffic is decryptable
5tls-auth/tls-crypt not enabled: without HMAC authentication on the control channel, the server is vulnerable to DoS via garbage TLS handshakes and CPU exhaustion

Firewall guidance

Use UDP 1194 for best performance (no TCP-over-TCP issues). If corporate firewalls block UDP: use TCP 443 (looks like HTTPS to DPI). Always enable tls-crypt (encrypts control channel + provides HMAC DoS protection). Restrict inbound 1194 to expected client IP ranges if possible. Pair with certificate-based auth (not just username/password).

Diagnosis commands

Check OpenVPN version (ensure patched for CVE-2023-46850)

shell

openvpn --version | head -1

Audit cipher suite and control channel protection

shell

grep -E 'cipher|auth|tls-crypt|tls-auth' /etc/openvpn/server.conf

Verify OpenVPN is listening on expected port/protocol

shell

ss -ulnp | grep 1194

Show connected clients and their virtual IPs

shell

cat /var/log/openvpn/status.log | head -20

Usage examples

Port 1194 – OpenVPN

shell

openvpn --config client.ovpn
openvpn --remote vpn.example.com 1194 udp
ss -ulnp | grep 1194

Common services on this port

OpenVPN CommunityOpenVPN Access ServerpfSense/OPNsense OpenVPNPritunlTunnelblick (macOS client)

Related ports

1194

OpenVPN default (this port, UDP)

443

OpenVPN over TCP 443 (firewall bypass)

51820

WireGuard (modern alternative)

500

IKE/IPsec (legacy VPN)

History

OpenVPN was created by James Yonan in 2001 as an open-source SSL VPN alternative to IPsec. Port 1194 was registered with IANA in 2004. OpenVPN uses OpenSSL/mbed TLS for encryption and runs in userspace (no kernel module needed). It dominated the VPN market until WireGuard (2018) offered dramatically simpler code (4,000 lines vs 100,000+), faster performance (kernel-space), and modern cryptography. OpenVPN remains widely deployed due to ecosystem maturity and Access Server's enterprise features.

FAQ

OpenVPN vs WireGuard – which should I use?

WireGuard: faster (kernel-space, ~3x throughput), simpler config (5 lines vs 50+), modern crypto (ChaCha20, Curve25519), lower battery usage on mobile. OpenVPN: more mature, TCP fallback for restrictive firewalls (WireGuard is UDP-only), obfuscation plugins for censorship resistance, broader OS support (legacy systems). New deployments: WireGuard unless you need TCP fallback or specific enterprise features (LDAP auth, per-user access rules).

How do I harden an existing OpenVPN deployment?

1. Use tls-crypt (replaces tls-auth, adds encryption of control channel). 2. Set cipher AES-256-GCM and auth SHA256. 3. Set tls-version-min 1.2. 4. Use certificate-based auth with CRL checking. 5. Set reneg-sec 3600 (force TLS renegotiation hourly). 6. Disable comp-lzo (compression oracle attacks, VORACLE). 7. Use --verify-x509-name to pin server certificate. 8. Keep OpenVPN updated (2.6.x minimum).