Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsYes, a single VPS can run OpenVPN and an HTTPS website, but an ordinary OpenVPN TCP service and an HTTPS server cannot both directly listen on the same IP address and TCP port 443. The dependable default is to keep the website on TCP 443 and run OpenVPN on UDP 1194 (or another dedicated UDP port). If a restrictive network requires OpenVPN over TCP 443, use a protocol-aware forwarding design such as OpenVPN Access Server’s service forwarding rather than starting two independent TCP listeners.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
The port rule that determines the design
A listening socket is identified by its local IP address, transport protocol and port. On a normal VPS, one process owns a given TCP socket. Consequently, an HTTPS server and an independent OpenVPN TCP daemon cannot both bind the same address on TCP 443. The second service will fail to start, or an administrator may accidentally expose one service where the other was expected.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
TCP and UDP are separate transports. A web server can own TCP 443 while OpenVPN owns UDP 1194 without any socket conflict. This is why the two-port arrangement is the normal solution, even though both services use the same public IP address.
OpenVPN’s documentation states that it works best over UDP. TCP 443 is primarily a compatibility fallback because outbound HTTPS is commonly permitted on restrictive networks. It is not automatically the fastest or most reliable transport for a VPN.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Choose an architecture before changing services
| Pattern | Public listener | How it works | Best use | Main trade-off |
|---|---|---|---|---|
| A. Separate protocol and port | Website: TCP 443; OpenVPN: UDP 1194 or another unused UDP port | Nginx or Apache terminates HTTPS, while OpenVPN has its own UDP socket. | Most installations and networks that permit UDP. | Clients on networks that block or heavily restrict UDP need another profile or fallback. |
| B. Access Server service forwarding | Access Server TCP daemon: TCP 443; web services commonly: TCP 943 | The Access Server daemon recognizes browser traffic and forwards it to the web service or another configured backend. | Deployments that must make OpenVPN reachable on TCP 443 while retaining browser access. | Forwarding, daemon interfaces and web-service ports must be kept consistent; a mistake can hide the web UI. |
| C. Front-end proxy | One front-end process owns TCP 443 | The front end routes traffic to backends using a protocol-aware design. | Teams with a tested proxy architecture and a clear OpenVPN compatibility plan. | TLS, SNI and OpenVPN protocol handling are deployment-specific; a generic HTTP reverse proxy is not enough. |
Pattern A: the stable Nginx/Apache plus UDP layout
For a public website and a conventional OpenVPN server, this is the layout to implement first:
- Nginx or Apache listens on TCP 80 if you need HTTP redirects and on TCP 443 for HTTPS.
- OpenVPN listens on UDP 1194, the documented community default, or another dedicated UDP port that is not already in use.
- The VPS firewall and any cloud security group allow only the website ports you actually use and the selected OpenVPN UDP port.
- DNS points the website hostname and the VPN hostname to the VPS public IP address. OpenVPN recommends using a fully qualified domain name for the server identity.
The website and VPN can use separate hostnames even when they resolve to the same address. For example, a site hostname can be used for the certificate and a VPN hostname can be embedded in client profiles. The names do not create separate sockets; the TCP/UDP and port choices do.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Prerequisites
- A reachable public IPv4 address, IPv6 address, or both, with DNS records that match the addresses clients will use.
- Root or administrator access to configure listeners, certificates, firewall rules and OpenVPN.
- A certificate and private key for the HTTPS hostname. The private key must be protected but readable by the Nginx master process if Nginx is the TLS terminator.
- A record of the current OpenVPN hostname, interface, protocol and port before making changes.
- A maintenance path, such as an existing console or out-of-band access, in case a listener change makes a web interface unreachable.
Configure the HTTPS listener
In Nginx, the HTTPS server block must enable SSL on the listening socket and specify the certificate and private-key files. A minimal shape is:
server {
listen 443 ssl;
server_name site.example;
ssl_certificate /etc/ssl/site/fullchain.pem;
ssl_certificate_key /etc/ssl/site/private.key;
root /srv/www/site;
index index.html;
}Use the actual certificate paths and hostname for your deployment. Confirm that the certificate covers the name visitors enter in their browsers and that the private-key permissions do not allow ordinary users to read it. If Apache terminates TLS instead, configure its HTTPS virtual host and certificate locations there; do not leave Nginx and Apache competing for the same TCP 443 socket.
Configure OpenVPN on its own UDP port
Set the OpenVPN server protocol to UDP and choose the port used by the client profiles. UDP 1194 is the documented default, but another unused UDP port is valid when your network policy requires it. The important properties are that the daemon binds the intended public interface and that no other process already owns the UDP socket.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Every client profile must reference the same public hostname or address, protocol and port. If you change any of those values, redistribute updated profiles rather than assuming existing clients will discover the change.
Open only the required firewall paths
| Traffic | Typical rule | Purpose |
|---|---|---|
| HTTP | TCP 80, if used | Serve an HTTP-to-HTTPS redirect or an intentionally public HTTP site. |
| HTTPS | TCP 443 | Deliver the website from Nginx or Apache. |
| OpenVPN | UDP 1194, or your selected UDP port | Accept VPN handshakes and encrypted tunnel traffic. |
Apply equivalent rules in the VPS operating-system firewall and in the provider’s security group. Do not open TCP 1194 merely because OpenVPN uses 1194 in another configuration; the transport must match the daemon and the client profile.
Why UDP is normally the better OpenVPN transport
OpenVPN over UDP avoids wrapping one reliable, congestion-controlled protocol inside another. OpenVPN documentation describes UDP as its best-performing transport. TCP can be useful when outbound UDP is blocked, but TCP-over-TCP can produce retransmission and congestion interactions commonly called “TCP-over-TCP meltdown.” The result may be poor responsiveness or unstable throughput under packet loss, even when the VPS has ample bandwidth.
Use UDP for the primary profile whenever clients can reach it. If you provide a TCP 443 fallback, treat it as a compatibility profile rather than silently moving every client to TCP. No authoritative throughput benchmark is established for a combined website/VPN deployment, so avoid promising a particular speed improvement.
Pattern B: share TCP 443 with Access Server forwarding
OpenVPN Access Server has a service-forwarding design for the case in which its TCP daemon must own public port 443. Access Server web services commonly listen on TCP 943. The TCP daemon examines incoming requests: browser requests can be forwarded internally to the web service, while OpenVPN client traffic is handled by the VPN service.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
This is not the same as running two unrelated daemons on TCP 443. Access Server remains the single process that owns the public socket and performs the distinction and forwarding. Its forwarding documentation also describes sending browser traffic to an Apache or Nginx service through port 443 and configuring custom local redirection. The exact backend ports and TLS arrangement depend on the Access Server release and your chosen web server.
Plan the forwarding path
- Decide which component terminates TLS for the public hostname. The certificate and private key must be installed on that component, not merely on a backend that never sees the TLS connection.
- Confirm the Access Server TCP daemon is the only process configured to bind public TCP 443.
- Keep the Access Server web service on its configured internal port, commonly TCP 943, unless you have a specific reason to change it.
- Configure service forwarding so browser requests reach the intended Access Server UI or internal web backend. If the goal is an independent website, define its internal listener and forwarding destination explicitly.
- Test the client web UI and any server-locked profiles before disabling forwarding, changing interfaces or moving web services.
- Document the final public hostname, protocol, port and backend ports so future profile generation and firewall changes use the same values.
A common failure is to change the daemon interface or disable forwarding while assuming the web UI remains on its former address. The VPN may still accept connections while administrators lose browser access. Keep console access available and make one listener change at a time.
When forwarding is the right answer
- Use it when a client network permits TCP 443 but blocks UDP and you cannot expose a separate TCP port.
- Use it when Access Server is already the managed VPN platform and its forwarding behavior is supported by your deployment.
- Do not use it merely to make two independent TCP services “share” a port; without a single front-end owner and protocol-aware forwarding, that arrangement cannot work.
Pattern C: a front-end proxy
A front-end proxy can own public TCP 443 and route requests to internal services, but OpenVPN traffic is not ordinary HTTP. The front end must preserve the OpenVPN protocol, handle TLS and SNI consistently, and send browser requests to the correct HTTPS backend. A layer-7 HTTP reverse proxy cannot simply proxy every byte to an OpenVPN TCP daemon.
Because the correct configuration depends on the proxy, OpenVPN mode, certificate placement and whether the VPN uses TLS on the outer connection, treat this as an architecture project rather than a copy-and-paste recipe. Access Server’s documented forwarding mechanism is the better-defined option when it matches your requirements.
Recommended Free Tools
HTTPS certificate and TLS checks
NGINX’s HTTPS guidance requires the ssl parameter on the listening socket and explicit certificate and private-key paths. Verify all of the following on the actual TLS terminator:
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- The server block or virtual host listens on TCP 443.
- The requested hostname appears in the certificate’s names.
- The certificate chain presented to browsers is complete.
- The private key matches the certificate and is readable by the Nginx master process, but not by unauthorized accounts.
- No Access Server forwarding rule is sending browser traffic to a service that presents a different certificate.
If browsers show a certificate error after a port change, first identify which process answered TCP 443. A correct certificate on the wrong process does not fix the connection; the process that owns the public socket must present the expected certificate.
Testing procedure after deployment
- Check listeners on the VPS and verify that the website’s process owns TCP 443, or that Access Server is intentionally the forwarding owner. Confirm OpenVPN owns the selected UDP port.
- From a normal network, open the HTTPS hostname and confirm the expected website, certificate name and certificate chain.
- Connect with an OpenVPN profile using the configured protocol and port. Confirm that the profile’s remote hostname matches the public DNS record.
- Test the VPN and website independently. A successful web request does not prove that the VPN listener or firewall rule is correct.
- If TCP 443 fallback is part of the design, test it from a network that blocks or restricts UDP. Verify that browser requests still reach the intended site or Access Server UI.
- Inspect service logs and firewall counters if a test fails, then change one variable at a time.
Troubleshooting common symptoms
The website displays the OpenVPN portal
TCP 443 is probably owned by Access Server, or service forwarding is directing browser requests to its web UI. Inspect which process owns the socket, review forwarding destinations and verify the web-service port. If the independent site should be public on 443, either return to Pattern A or configure a supported forwarding path to the site backend.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11OpenVPN clients stopped connecting after a change
Changing the hostname, interface, protocol or port can invalidate existing client profiles. Generate or redistribute profiles with the new public settings, verify DNS resolution and confirm that the firewall allows the selected transport. A client using UDP cannot connect to a daemon moved to TCP, even when the numeric port is unchanged.
The VPN starts but the website will not start
Two services are competing for TCP 443. Stop the second listener only after confirming console access, then assign the website TCP 443 and move OpenVPN to UDP or to a deliberately configured forwarding design. Do not solve the conflict by opening an arbitrary additional port without updating DNS, firewall rules and client profiles.
HTTPS shows the wrong certificate
The wrong process or virtual host is answering. Check the public address, SNI hostname, certificate paths and forwarding chain. In an Access Server design, determine whether Access Server or the backend web server is terminating TLS; install and renew the certificate on that terminator.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
TCP VPN performance is poor
Move clients to UDP when their network permits it. TCP-over-TCP behavior can amplify retransmissions and latency under loss. Keep the TCP 443 profile for restrictive networks rather than treating it as a universal replacement for UDP.
The Access Server web UI disappeared
A forwarding or interface change may have removed the path to the web service, commonly on TCP 943. Use console or administrative access to restore the previous forwarding rule or listener, then retest the UI before making another change. Preserve a known-good profile and record the original ports.
Operational safeguards
- Reserve a maintenance window for listener and certificate changes.
- Keep an out-of-band console path so a mistaken bind or forwarding rule does not lock you out.
- Record every public hostname, protocol, port, certificate owner and backend destination.
- Renew certificates before expiry and verify renewal does not restart the wrong service or reclaim TCP 443.
- Limit firewall exposure to the ports and source ranges required by the website and VPN.
- After upgrades, recheck Access Server forwarding and web-service ports because interface defaults can change with configuration edits.
- Maintain separate client profiles for UDP and any TCP 443 fallback, with clear names indicating the transport.
Decision checklist
Choose the simplest design that satisfies the networks your users actually use:
- If UDP is allowed: put Nginx or Apache on TCP 443 and OpenVPN on UDP 1194 or another dedicated UDP port.
- If UDP is blocked and TCP 443 is mandatory: use Access Server service forwarding or another tested protocol-aware front end.
- If you need an independent website and Access Server already owns 443: verify exactly where TLS terminates and where browser requests are forwarded before changing ports.
- If no forwarding design is available: use a separate TCP port for OpenVPN and update firewall rules and client profiles accordingly.
The key test is not whether both products are installed on the VPS; it is whether one intentional process owns each public socket and every other service is reached through a documented internal path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
