1194

Port 1194/tcp is registered with IANA as openvpn with the description "OpenVPN," assignee James Yonan, registration date 2004-11, and a blank reference field (dual-registered on TCP and UDP). OpenVPN is an open-source VPN daemon that builds encrypted point-to-point or site-to-site tunnels using a custom security protocol layered on SSL/TLS for key exchange and authentication. The canonical transport for OpenVPN is UDP/1194, which is the preferred operational default: wrapping a TCP tunnel inside another TCP connection causes competing retransmission timeouts (the "TCP Meltdown" problem), so TCP/1194 is reserved for cases that need reliable ordered delivery or where UDP is blocked by a restrictive firewall. When deep-packet-inspection firewalls block both, the usual fallback is TCP/443 (to masquerade as HTTPS), not TCP/1194. Common software answering on this port includes the open-source OpenVPN reference implementation, OpenVPN Access Server (commercial), pfSense and OPNsense firewalls, SoftEther VPN, and macOS clients such as Viscosity and Tunnelblick; many consumer routers ship OpenVPN support defaulting to 1194. For an analyst, an open 1194 is a strong VPN-gateway fingerprint, and a compromise of the daemon grants access to the internal network behind the tunnel — so it is a recurring target. Notable risks span denial-of-service (CVE-2020-15078, CVE-2017-7521, CVE-2025-2704 affecting 2.6.1–2.6.13), a 2024 Windows RCE/local-privilege-escalation chain (CVE-2024-27459, CVE-2024-24974, CVE-2024-27903), a critical heap buffer over-read in the 2.7 alpha/rc address parser (CVE-2025-12106), and man-in-the-middle exposure when weak TLS ciphers are used or the server certificate is not validated. Scanners index 1194 to fingerprint VPN gateways and their software versions, so keeping OpenVPN patched, pinning certificates, enforcing strong ciphers, and rate-limiting are the primary mitigations.

IANA assignment

openvpn — "OpenVPN"; reference (blank — no RFC cited in IANA registry); assignee James Yonan; registration date 2004-11; dual-registered 1194/tcp + 1194/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Related ports

TCP/443 (HTTPS-masquerade fallback), UDP/1194 (preferred OpenVPN transport), UDP/500 + UDP/4500 (IPsec/IKE VPNs for contrast)

Primary use

OpenVPN VPN daemon — encrypted tunnel over a custom SSL/TLS-based protocol; UDP/1194 is the preferred transport, TCP/1194 used when reliable delivery is needed or UDP is blocked

Other/unofficial uses

TCP/443 is the common DPI-evasion fallback rather than TCP/1194

Common software

OpenVPN (open-source), OpenVPN Access Server (commercial), pfSense, OPNsense, SoftEther VPN, Viscosity, Tunnelblick; many consumer routers default here

Security implications

VPN-gateway target — compromise reaches the internal network. DoS (CVE-2020-15078, CVE-2017-7521, CVE-2025-2704 affecting 2.6.1–2.6.13); 2024 Windows RCE/LPE chain (CVE-2024-27459, CVE-2024-24974, CVE-2024-27903); critical heap over-read in 2.7 alpha/rc (CVE-2025-12106); MitM with weak ciphers or unvalidated server certs; UDP reflection/amplification when misconfigured

Typically seen on

VPN gateways, firewalls/routers (pfSense, OPNsense, consumer routers), remote-access servers

Internet-wide exposure

specific Shodan/Censys counts for 2024–2025 not available in public search at research time [Unknown]

Analyst note

An open 1194 reliably marks a VPN gateway; banner/version fingerprinting drives targeting of unpatched instances. Prefer UDP/1194 operationally; treat exposed, outdated daemons as high-value.

Port 1194/udp is the default port for OpenVPN, and it is a clean vendor registration: IANA registers openvpn with the description "OpenVPN," assignee and contact James Yonan, with a registration date of November 2004, and a blank reference field. The same registration covers 1194/tcp, so both transports belong to OpenVPN. OpenVPN is an SSL/TLS-based VPN created by James Yonan — first released privately in 2001, with the SourceForge project appearing in March 2002. It uses OpenSSL (or mbedTLS from version 2.3 onward) to run a TLS handshake on a control channel that negotiates keys, after which an encrypted data channel carries the tunnel over a TUN (layer-3) or TAP (layer-2) virtual interface. UDP is the default transport (1194) for performance, but TCP is fully supported and is very frequently run on 443/tcp so the traffic masquerades as ordinary HTTPS and slips past DPI and restrictive firewalls. OpenVPN supports pre-shared-key, certificate, and username/password authentication, with perfect forward secrecy; the 1194 default has been in place since the 2.0 beta series (earlier versions used port 5000). Security-wise, exposed OpenVPN endpoints face credential and brute-force attacks and are fingerprintable by DPI (which the 443/tcp mode mitigates); the software is secure when configured with certificates and MFA and kept patched, though a CVE history across releases means currency matters. For an analyst, an open 1194/udp indicates an OpenVPN server; UDP scans often show open|filtered, so corroborate with a handshake probe, and bear in mind the endpoint may instead be hiding on 443/tcp.

IANA assignment

openvpn — "OpenVPN"; reference (blank — no RFC cited in IANA registry); assignee/contact James Yonan; registered 2004-11; same registration covers 1194/tcp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry (confirmed verbatim from live CSV this session)

Range class

registered (1024–49151)

Prevalence

in Nmap's default top-1000 UDP ports (de-facto, nmap-services) [Well-established] — nmap-services file

Related ports

1194/tcp (same service), 443/tcp (stealth mode), 51820 (WireGuard), 500/4500 (IPsec)

Primary use

default OpenVPN VPN listener

Other/unofficial uses

OpenVPN over 443/tcp to evade DPI/firewalls; 1194/tcp (same registration) [Well-established]

Security implications

credential/brute-force attacks on exposed endpoints; DPI-fingerprintable (mitigated by 443/tcp); secure with certs/MFA + patching; CVE history across releases

Typically seen on

OpenVPN Access Server, pfSense/OPNsense, commercial VPN providers, PiVPN

Analyst note

An open 1194/udp = OpenVPN server. UDP scans often show open|filtered; corroborate with a handshake probe. The endpoint may instead be hiding on 443/tcp.