PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchShort answer: A standard OpenVPN community server normally listens on UDP 1194. Open that exact UDP port in the server firewall and, if the server is behind a router, forward it to the VPN host. If you deliberately configure OpenVPN for TCP, open the configured TCP port instead; OpenVPN Access Server commonly provides TCP 443 as a TCP fallback. Its separate web interfaces normally use TCP 943, which is not the VPN tunnel port.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
The correct rule is not “always open 1194.” The server’s protocol and port, host firewall, cloud security group, NAT gateway, and client configuration must all agree. The sections below show how to identify the listener, publish it safely, and diagnose mismatches.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe port answer at a glance
| Deployment or service | Typical protocol and port | What it carries | Is it required? |
|---|---|---|---|
| OpenVPN Community server default | UDP 1194 | VPN tunnel connections | Yes, when you leave the default configuration unchanged |
| OpenVPN configured for TCP | The TCP port you select | VPN tunnel connections over TCP | Only when the server and clients are configured for TCP |
| Access Server VPN TCP fallback | TCP 443 | VPN tunnel connections over TCP | Optional; commonly enabled for networks that permit HTTPS-like traffic |
| Access Server web services | TCP 943 | Admin and Client Web UIs | Only when users or administrators need web access; it is not the tunnel listener |
| Custom OpenVPN listener | Any selected port from 1 through 65,535 | VPN tunnel connections | Only the protocol and port you configure and publish |
The community defaults and firewall behavior are documented in the OpenVPN 2.4 manual and the OpenVPN 2.7 manual. Access Server’s separate daemon and web-service listeners are described in its daemon ports tutorial and web-services ports tutorial.
How OpenVPN chooses its listener
Community edition defaults
The sample community server configuration creates a routed TUN interface and listens for client connections on UDP 1194. The manual describes OpenVPN’s single-UDP-port design as relatively firewall-friendly and shows an iptables rule that permits incoming UDP traffic on that port. If you did not change proto or port, this is the rule to implement.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Protocol is part of the port definition
A port number without a protocol is incomplete. UDP 1194 and TCP 1194 are different sockets, and a firewall rule for one does not permit the other. The proto setting selects the transport: proto udp for the normal deployment or proto tcp when TCP is needed. The client profile must use the same protocol and destination port.
TCP is an alternative, not an automatic second listener
TCP can help when a network blocks or mishandles outbound UDP. It is generally less efficient and less robust than UDP on unreliable or congested links because it adds transport-level retransmission and can create TCP-over-TCP performance problems. The community configuration guide states that running both transports requires two separate OpenVPN instances, each with its own listener and configuration; changing a single instance from UDP to TCP does not make both available. See Creating Configuration Files for Server and Clients.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →OpenVPN Access Server has two different port groups
VPN daemon listeners
Access Server commonly exposes a UDP listener on 1194 and a TCP listener on 443. Both are VPN daemon ports and both can be changed in the administration interface. TCP 443 is offered as a fallback because many restrictive networks allow outbound traffic that resembles ordinary HTTPS. That does not make it inherently more secure, and it does not remove the need for matching client profiles and firewall rules.
Web and administration services
Access Server’s documented web-service layout uses TCP 943 for the Admin Web UI and Client Web UI. Opening this port is necessary only for the web functions you intend to expose. It is not required for an already provisioned client to establish a tunnel through the VPN daemon listener. Treat web administration as a separate exposure: limit the source networks where practical, use strong authentication, and avoid publishing an administrative interface to the entire internet unless your operating requirements demand it.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
When TCP 443 and TCP 943 coexist
In a typical Access Server layout, the VPN’s TCP fallback and the web service are distinct services even though both are web-relevant in purpose. Verify the product’s current binding and front-end arrangement before creating a rule, because changing listener assignments can alter which service answers on a given address and port. Do not label TCP 943 as the tunnel port simply because it is an Access Server default web port.
Custom ports: when and how to use them
OpenVPN permits any port from 1 through 65,535; 1194 is a convention and default, not a protocol requirement. A custom port can fit an existing firewall policy, avoid a collision with another service, or satisfy an address-and-port design used by your organization. It does not hide a VPN from serious scanning, so do not treat port selection as a security control.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Change the server and client together
- Choose an unused port and decide whether the transport will be UDP or TCP.
- Set the server’s
portandprotovalues (or the equivalent Access Server settings). - Update every client profile’s
remotedestination and protocol so it names the new public port. - Permit that exact protocol and port in the host firewall, cloud network policy, and any edge firewall.
- If NAT is involved, forward the public port to the server’s internal address and internal listener.
- Restart or reload the service, then test from a network outside the server’s LAN.
Changing only one layer produces a predictable failure: the service may be listening, but packets never reach it; packets may arrive, but the host drops them; or the client may still dial the old endpoint.
Router and NAT forwarding
Direct public address
If the VPN host owns the public address, allow the listener in its operating-system firewall and in any upstream cloud or network firewall. No port-forwarding rule is required because there is no translation between the internet and the host.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Server behind a home or office gateway
When the host has a private address, create a destination-NAT or port-forward rule on the edge gateway. The external protocol and port must match the OpenVPN listener, and the gateway must translate them to the host’s private IP and the corresponding internal port. A host firewall rule alone cannot make a private server reachable from the internet. OpenVPN’s VPN Server Behind Firewall guide covers this deployment pattern.
Use a fixed DHCP lease or static address for the VPN host so the forwarding rule does not silently point to a different device. If your gateway has separate “WAN service” and “LAN service” fields, configure the public side and internal destination explicitly; do not assume that selecting a device automatically opens the required protocol.
Cloud deployments
Cloud instances add another enforcement layer. Permit the listener in the provider’s security group, network ACL, or virtual network firewall as well as in the operating-system firewall. If a managed load balancer or public IP performs translation, confirm that it supports the chosen UDP or TCP transport and that its health checks are not being mistaken for VPN traffic.
Host-firewall examples and verification
Linux firewall rule
Permit the configured protocol and port in the host firewall. For the untouched community default, the equivalent iptables rule is an inbound allowance for UDP destination port 1194, as shown in the official manual. With a different configuration, substitute your actual protocol and port rather than copying the default literally.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Confirm what the daemon is really listening on
Check the running service configuration and the operating system’s socket table. On Linux, commands such as ss -lntup can show whether OpenVPN has a UDP or TCP socket and which local address it uses. A listener bound only to loopback will not accept traffic arriving on the public interface. For Access Server, use its administration settings and service status rather than assuming the documented defaults remain unchanged.
Test from outside the LAN
Testing from the VPN host’s own network can be misleading because some routers lack NAT loopback. Try a mobile hotspot or another external connection. For UDP, a generic TCP port checker cannot prove that the VPN is reachable; inspect the server logs while initiating a real client connection. For TCP, a successful TCP handshake proves reachability to that socket but not successful TLS or certificate authentication.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Client configuration must match exactly
In a client profile, the remote line identifies the public hostname or address and port, while the protocol setting determines whether the connection uses UDP or TCP. Ensure that:
- The hostname resolves to the current public address.
- The numeric port equals the edge gateway’s public listener.
- The protocol matches the server socket and every firewall rule in the path.
- The profile is not forcing a different transport through an additional directive.
- Any Access Server profile intended for TCP fallback was generated or edited for that fallback rather than manually changing only the number.
If one profile must work on both friendly and restrictive networks, provide separate UDP and TCP profiles or use the product’s documented multi-daemon arrangement. A single client profile cannot connect to two transports merely because both ports are open.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Common failure modes and fixes
“The port is open, but no client connects”
- Verify that the daemon is running and listening on the expected local address.
- Compare the server’s
proto/portvalues with the client’sremoteline. - Check the host firewall, then the cloud security group or edge firewall.
- Inspect NAT forwarding and confirm that the internal address has not changed.
- Review server logs for incoming packets, TLS errors, certificate failures, or authentication rejection.
“UDP works, TCP does not”
Confirm that a separate TCP instance or Access Server TCP daemon is enabled. Opening a TCP rule does not convert a UDP-only process into a TCP listener. Also check that the chosen TCP port is not already occupied by a web server or another service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“TCP works only on some networks”
Restrictive networks may permit outbound TCP but still intercept, proxy, or filter particular destinations. Test from more than one access network and document which profile is intended for fallback. Do not assume that using a commonly allowed destination port bypasses all policy controls.
“The web UI works, but the VPN tunnel fails”
Web access and tunnel access use separate listeners in the documented Access Server layout. Confirm that the client is dialing the VPN daemon port, not the web-service port, and that the daemon’s protocol is allowed end to end.
“Port forwarding appears correct, but the public address is unreachable”
Check for carrier-grade NAT or a second router. If your gateway does not receive a true public IPv4 address, an inbound forwarding rule may never see internet traffic. You may need a provider-assigned public address, a routed IPv6 design, or another supported topology.
A deployment checklist
- Read the active server configuration and record the protocol and listener port.
- Decide whether you need only the normal UDP tunnel, a TCP fallback, or both through separate instances.
- Allow the exact protocol and port in the host firewall.
- Add the same rule to cloud security groups, network ACLs, or managed firewalls.
- For NAT, forward the public listener to the VPN host’s fixed private address and internal listener.
- Keep Access Server web-service access separate; add its web port only for required UI access and restrict administrative sources.
- Regenerate or update client profiles so hostname, protocol, and port agree.
- Test from an external network while watching logs, then remove temporary broad rules.
Choosing the right arrangement
| Situation | Practical choice | Reason |
|---|---|---|
| Normal community deployment with no filtering problem | Use the default UDP listener | It is the documented default and usually has lower overhead than TCP |
| Outbound UDP is blocked or unreliable on a particular network | Enable a separately configured TCP listener or use Access Server’s TCP fallback | TCP may traverse networks that reject UDP, with efficiency trade-offs |
| Need a non-default policy or avoid a local service collision | Select an unused custom port and update every layer | OpenVPN supports the full 1–65,535 range |
| Server has a private address | Combine host rules with an edge port-forward | Internet packets must be translated to the VPN host |
| Users need browser-based administration | Publish the separate Access Server web service only as required | Web UI access is distinct from tunnel connectivity |
The safest operational design is the smallest exposure that meets your users’ connectivity requirements: one documented tunnel listener, narrowly scoped firewall rules, and a separately controlled management interface.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
