Port reference
Port 1194 (UDP/TCP) – OpenVPN
OpenVPN — a TLS-based open-source VPN providing encrypted remote-access and site-to-site tunnels.
Quick facts
- Transport
- udp, tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on OpenVPN servers, typically internet-facing so remote users can connect. Defaults to UDP 1194, optionally TCP 1194/443.
What is port 1194 used for?
Port 1194 is the registered default for OpenVPN, a popular open-source VPN built on TLS/SSL. It creates encrypted remote-access and site-to-site tunnels, letting laptops and remote sites connect securely into a private network. It's used by OpenVPN Community Edition and Access Server, and is built into firewalls and routers like pfSense, OPNsense, and many consumer gateways. Traffic runs over UDP 1194 by default, or TCP when you need to get through restrictive firewalls.
When would you open it?
You'd forward port 1194 to your OpenVPN server when you want remote users or branch sites to reach your home or office network over an encrypted tunnel. This is only needed if you actually host the VPN server; VPN clients don't need any inbound port opened.
Is it safe to open?
The main risk is brute force or stolen credentials against an internet-facing endpoint, so use certificate authentication plus MFA, enable tls-crypt, and keep OpenVPN patched. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1194
nmap -p 1194 <target>netstat -ano | findstr :1194
Test-NetConnection <host> -Port 1194lsof -i :1194
nmap -p 1194 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1194 to your device's local IP, internal port 1194, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1194/tcpsudo firewall-cmd --permanent --add-port=1194/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1194 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1194" -Direction Inbound -Protocol TCP -LocalPort 1194 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against VPN auth
- Theft of client configs, keys, and certificates
- Denial of service against the VPN daemon
Hardening
- Enforce certificate auth plus MFA; disable password-only logins
- Use tls-auth / tls-crypt HMAC to drop unauthenticated packets
- Keep OpenVPN and OpenSSL patched against known CVEs
- Rate-limit and geo/IP-filter connection attempts; monitor auth logs
How to block this port
sudo ufw deny 1194/tcpsudo firewall-cmd --permanent --remove-port=1194/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1194 -j DROPNew-NetFirewallRule -DisplayName "Block 1194" -Direction Inbound -Protocol TCP -LocalPort 1194 -Action Blocknmap snippet
nmap -sU -p1194 --script openvpn-fingerprint <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does OpenVPN use TCP or UDP?
- By default OpenVPN uses UDP 1194 for performance, but it can run over TCP (often 443) to traverse restrictive firewalls and proxies.
- Is exposing OpenVPN on port 1194 safe?
- It is reasonably safe with certificate authentication, tls-crypt, MFA, and patching. Password-only setups are vulnerable to brute force and should be avoided.