OpenVPN other than UDP 1194 (i.e. TCP 21)

robi

I use OpenVPN on completely different ports than defaults, and I have no problem at all.

kpa

TCP port 21 is not a good choise because it collides with the command port of FTP. Try with some other custom TCP port, preferably on a port that is in range 1024-65535.

johnpoz

I run openvpn on 443 tcp and don't have any issues - use it daily..

m4f1050

Cool, will try 443! My problem is where I need to connect most of the time (work) has all the ports locked up, except for a few like 21, 80, 443, etc etc

Setting mine to 443 now! Thanks for the advise!

johnpoz

21 is prob not open very many places.. You can almost bet that 443 is though

m4f1050

Quick question, will this affect anything that uses odd ports (i.e. 8080, 8081, etc etc)? I have an unRAID NAS and I have my services on ports 8080, 8081, 8082, 8083, 4040, 9000

Currently using OpenVPN Connect (android)

Should I use a different OpenVPN client, maybe it's my client causing the issues?

divsys

I use OpenVPN Connect (android) all the time with many different sites. It works well for me.

As far other ports being affected, one of the nicest things about OpenVPN is that you can configure the ports it listens on (and if you want, what it sends on).
That's what it uses, period. I wouldn't expect any impact on the other ports you're using in your network.
Traffic routing is another matter entirely :)

robi

In most big places where they block outgoing ports, they have deep packet inspection too, so even if 443 is open, they'll notice that ovpn is not https-type data flow there, and they'll block it. Moreover, they'll know that somebody's trying something prohibited in their area…

m4f1050

Well, had to keep it UDP 1194. When I tried it after a while it did the same thing as port tcp 21.. I have a feeling These setup don't work in my network infrastructure, gotta check what's going on..

I'm using a Watchguard Firebox X700 with a 2gb cf card..

m4f1050

Any ideas anybody? Do I need to setup a Rule for TCP 443 under the firewall tab? or do I leave it with the 2 default rules?

johnpoz

When you setup the openvpn server it should setup the rule automatically for you. You should have a rule in your wan tab to your wan interface on the port openvpn is listening on.

m4f1050

I had to manually add the Rule before I could go to canyouseeme(dot)org and check for the port being opened. ???

m4f1050

BUMP - OpenVPN crashes my pfSense firewall when using port 443. Any advise? I can only use it UDP 1194 for the moment. When I try to use TCP 443 it crashes the firewall completely where it won't do anything and I have to hard reset it. Using a Watchguard Firebox X700

jimp

Move your GUI to another port first. The GUI and OpenVPN can't both be on 443 or you'll lose access to the GUI.

jimp

Though you could share using this mechanism:
https://doc.pfsense.org/index.php/Sharing_a_Port_with_OpenVPN_and_a_Web_Server

I would not recommend using that for the GUI since you don't want your GUI open to the world.

m4f1050

@jimp:

Move your GUI to another port first. The GUI and OpenVPN can't both be on 443 or you'll lose access to the GUI.

Its not just the gui crashing, its the whole firewall. I am not using https for the gui either… but will try again moving the gui out of port 80....

m4f1050

Simple stuff works great on port tcp 443. I just tried to copy a 200+ MB file and hard crashed my pfsense…

EDIT: Got to the firewall, here is what I found out...

No WAN ip address... So OpenVPN is crashing WAN's ip address somehow....

openvpn.jpg_thumb

m4f1050

Bump…