DevToolsmith

Port 1194: OpenVPN

Port 1194 (UDP and TCP) is the default port for OpenVPN. It is a registered port (1024–49151), so any user can listen on it.

Service
OpenVPN
Protocol
UDP and TCP
Range
Registered (1024–49151)
Official
IANA-registered
Exposure
Meant to be public
Category
Remote access

What uses port 1194

OpenVPN servers listen on UDP 1194 by default. UDP performs better for tunnels; TCP mode exists for networks that block UDP, and many providers also run OpenVPN on TCP 443 to get through restrictive firewalls. WireGuard (51820) is a simpler and faster alternative for new setups.

Should port 1194 be open to the internet?

Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.

Check what is listening on port 1194

Linux
sudo ss -ltnp 'sport = :1194'
sudo ss -lunp 'sport = :1194'
macOS
sudo lsof -nP -iTCP:1194 -sTCP:LISTEN
sudo lsof -nP -iUDP:1194
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 1194 -State Listen
Get-NetUDPEndpoint -LocalPort 1194
netstat -ano | findstr :1194

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 1194

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux
sudo kill $(sudo lsof -t -iTCP:1194 -sTCP:LISTEN)
Windows (PowerShell)
Stop-Process -Id (Get-NetTCPConnection -LocalPort 1194 -State Listen).OwningProcess

Open port 1194 in the firewall

Ubuntu / Debian (ufw)
sudo ufw allow 1194/udp
sudo ufw allow 1194/tcp
# Close it again:
sudo ufw delete allow 1194/udp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-port=1194/udp
sudo firewall-cmd --permanent --add-port=1194/tcp
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "OpenVPN 1194/UDP" -Direction Inbound -Protocol UDP -LocalPort 1194 -Action Allow
New-NetFirewallRule -DisplayName "OpenVPN 1194/TCP" -Direction Inbound -Protocol TCP -LocalPort 1194 -Action Allow

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 1194 from another machine

macOS / Linux
nc -zv example.com 1194
Windows (PowerShell)
Test-NetConnection example.com -Port 1194

Related ports

  • Port 51820 (WireGuard): the default port for WireGuard VPNs.
  • Port 443 (HTTPS): the default port for HTTPS, encrypted web traffic.

More remote access ports

22 (SSH) , 23 (Telnet) , 2222 (SSH (alternate)) , 3389 (RDP) , 5900 (VNC) , 5985 (WinRM (HTTP)) , 5986 (WinRM (HTTPS)) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 1194 used for?

Port 1194 is the default port for OpenVPN. OpenVPN servers listen on UDP 1194 by default. UDP performs better for tunnels; TCP mode exists for networks that block UDP, and many providers also run OpenVPN on TCP 443 to get through restrictive firewalls. WireGuard (51820) is a simpler and faster alternative for new setups.

Is it safe to open port 1194?

This port is meant to be reachable by clients on the internet when you run this service publicly. Keep the service behind it up to date and require authentication where it applies.

How do I check if port 1194 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :1194'" on Linux or "sudo lsof -nP -i :1194" on macOS. From another machine, run "nc -zv host 1194" or, on Windows, "Test-NetConnection host -Port 1194". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.