Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallYes, one VPS can host both services. The dependable design is to let Nginx or Apache own HTTPS on TCP 443 and run OpenVPN on UDP 1194 (or another dedicated UDP port). If VPN clients must connect over TCP 443, an ordinary web server and an independent OpenVPN TCP daemon cannot both bind that same socket; use OpenVPN Access Server’s service-forwarding design or a carefully engineered protocol-aware front end instead.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
Start with the port rule
A listening socket is identified by an IP address, transport protocol and port. On one VPS, only one process can normally listen on a particular TCP address and port combination. Therefore, an HTTPS server and a separate OpenVPN process cannot both directly own TCP 443 on the same public IP.
As an Amazon Associate I earn from qualifying purchases.
The protocol matters. TCP 443 and UDP 443 are different sockets, so they can coexist. More commonly, the website uses TCP 443 while OpenVPN uses UDP 1194. This arrangement avoids contention and follows OpenVPN’s documented preference for UDP. OpenVPN documentation describes TCP 443 as a fallback that is useful because restrictive networks often allow it, not as the best transport for every connection.
When someone says “share port 443,” determine whether they mean:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Different transports: HTTPS on TCP 443 and OpenVPN on UDP 443. This is technically possible, although using UDP 1194 keeps the roles clearer.
- The same TCP socket: HTTPS and OpenVPN TCP both need TCP 443. They require a forwarding or proxy layer; two independent daemons cannot bind it simultaneously.
Choose the deployment pattern
| Pattern | Public listeners | When to use it | Main trade-off |
|---|---|---|---|
| A. Separate protocol and port | Website: TCP 443 (and usually TCP 80 for redirect); OpenVPN: UDP 1194 | Almost every self-managed VPS where clients can reach UDP | Requires the VPN network to permit UDP 1194 or your chosen UDP port |
| B. Access Server service forwarding | Access Server’s TCP daemon owns TCP 443; its web services commonly remain on TCP 943 | VPN users need a TCP 443 fallback and you are using OpenVPN Access Server | Forwarding must be configured correctly or browsers may see the VPN portal instead of the site |
| C. Front-end proxy | One protocol-aware front end owns TCP 443 and routes traffic to backends | Organizations that already operate a tested TLS/SNI and VPN proxy design | Implementation is deployment-specific; ordinary HTTP reverse-proxy rules are not enough for OpenVPN’s protocol |
For a new installation, start with Pattern A. It is the least fragile, leaves TLS termination in the web server, and preserves OpenVPN’s preferred UDP transport. Move to Pattern B only when TCP 443 connectivity is a real requirement, such as a network that blocks the VPN’s UDP port.
Prerequisites and planning
Prepare the VPS before changing either service:
- Reachable identity: Use a public IP address or a DNS name that resolves to it. OpenVPN recommends an FQDN for the server identity; use the same hostname consistently in website certificates and client profiles where appropriate.
- Administrative access: You need root or equivalent administrator privileges to install services, edit listeners, protect certificate keys, and change the VPS firewall or cloud security group.
- Address and port inventory: Decide whether the website will answer on TCP 80 as well as TCP 443, select the OpenVPN port, and check that no existing process owns those sockets.
- Certificate and key: Obtain a certificate covering the website hostname. The private key must be readable by the Nginx master process (or the account used by your chosen web server) while remaining inaccessible to ordinary users.
- Client profile plan: Changing an OpenVPN hostname, interface, protocol or port can invalidate existing profiles. Keep a copy of the current configuration and plan how updated profiles will reach users.
On a Linux VPS, these checks show current listeners (run as an administrator):
ss -ltnp # listening TCP sockets and owning processes
ss -lunp # listening UDP sockets and owning processesDo not proceed until you know which process owns each selected socket. A service that is already bound to TCP 443 will prevent another service from starting there, often producing an “address already in use” error.
Pattern A: HTTPS on TCP 443 and OpenVPN on UDP 1194
1. Point DNS at the VPS
Create an A (and, if you use IPv6, an AAAA) record for the website hostname. If the VPN uses a separate name, create a record for that name too. Wait for the records to resolve to the VPS before issuing a certificate or distributing profiles. A public hostname is preferable to embedding a changing address in client configurations.
2. Configure the web server as the sole TCP 443 listener
For Nginx, the HTTPS server block must explicitly enable SSL on the listening socket and identify the certificate and private-key files. A minimal illustrative block is:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name www.example.net example.net;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
root /var/www/example;
index index.html;
}The exact certificate paths, document root and additional TLS policy depend on your operating system and certificate provider. Keep the private key permissions tight, test the configuration before reloading Nginx, and ensure the certificate’s names match the hostname visitors use. Apache follows the same ownership principle: enable its SSL virtual host on TCP 443 and do not configure a second TCP service for that address and port.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
If you want HTTP-to-HTTPS redirection, let the web server own TCP 80 as well. TCP 80 is independent of both TCP 443 and UDP 1194.
3. Bind OpenVPN to a dedicated UDP port
Use the community OpenVPN default of UDP 1194 unless your network policy calls for another unused UDP port. In the server configuration, set the protocol and port deliberately rather than relying on an accidental package default. A conceptual configuration contains:
port 1194
proto udpKeep the VPN listener on the VPS’s public interface (or on the intended private interface when another gateway performs NAT). Do not change the web server’s TCP 443 listener to make room for OpenVPN; the services do not need the same port in this pattern.
4. Open only the required firewall paths
Permit TCP 80 and TCP 443 if the site needs both, and permit UDP 1194 for VPN clients. Apply the same rules in the VPS provider’s security group or network ACL; a host firewall rule cannot override a blocked upstream security group.
# Example with UFW; adapt to your policy and administration source
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 1194/udpDo not open TCP 1194 merely because the VPN uses UDP, and do not expose Access Server’s administrative ports publicly unless your design requires it. Restrict administrative access by source address or a management network where possible.
5. Generate and distribute matching client profiles
Each client profile must specify the public VPN hostname or address, the selected UDP protocol and port. If you change any of those values later, regenerate or redistribute profiles as required. A profile that still points at an old port will fail even when the server is healthy.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
6. Start and validate services independently
- Validate and reload the web server. Confirm it reports a successful configuration test before reloading.
- Start or restart OpenVPN and check its service log for a successful bind to UDP 1194.
- From an external network, open the HTTPS hostname and verify the expected certificate and page.
- Connect one VPN client using a current profile, then verify that the VPN assigns an address and that the intended private routes work.
- Test from a restrictive network, such as a guest or cellular network, only if you need to know whether UDP 1194 is filtered. If it is blocked, use a documented TCP fallback rather than silently changing the production listener.
Testing the website and VPN separately makes failures easy to localize: an HTTPS error belongs to DNS, TCP 443, TLS or the web server; a VPN error belongs to the UDP path, OpenVPN configuration, credentials or profile routing.
Pattern B: Use Access Server service forwarding on TCP 443
OpenVPN Access Server provides a service-forwarding design for deployments that need a TCP 443 VPN endpoint while still serving web traffic. In this arrangement, Access Server’s TCP daemon owns the public TCP 443 socket. Its web services commonly listen on TCP 943, and the forwarding layer recognizes browser requests and sends them to the appropriate web service. The same mechanism can forward to an Apache or Nginx service through 443 using a custom local redirection.
This is not the same as running an independent OpenVPN TCP daemon beside Nginx. Access Server is the process that owns 443 and makes the routing decision.
Plan the forwarding roles
- Public entry point: TCP 443 terminates at Access Server’s TCP daemon.
- Access Server web service: Keep the web UI on its configured internal port, commonly TCP 943, unless your supported configuration specifies another port.
- Website backend: Run Nginx or Apache on a different local port or address, then configure forwarding to that backend. Do not have the backend independently bind the same public TCP 443 socket.
Apply changes in a safe order
- Record the current Access Server hostname, interfaces, ports and profile settings. Export or otherwise preserve known-good client profiles.
- Confirm the website works directly on its backend address and port before adding forwarding.
- Enable the Access Server service-forwarding rule that distinguishes browser requests and routes them to the web UI or the website backend. Use the product’s supported forwarding and custom local-redirection settings rather than an improvised second listener.
- From an external browser, test the public hostname and confirm that the intended site appears. Separately test the Access Server client web UI and an actual VPN connection.
- Only after those checks should you disable an old forwarding rule, change the daemon interface, or alter the public hostname and port. Such changes can make both the VPN and its web UI unreachable and can require new client profiles.
A common symptom of a forwarding mistake is seeing the OpenVPN login or client portal when you expected the public website. That means TCP 443 is reaching Access Server, but the browser request is being handled by the Access Server web service instead of the website backend. Inspect the forwarding destination, the web-service port and the backend listener; do not try to solve it by starting another process on TCP 443.
Pattern C: Put a protocol-aware front end in front
A single front-end process can own TCP 443 and route different traffic types to backend services. This approach requires deliberate handling of TLS, SNI and the OpenVPN protocol. A conventional HTTP reverse proxy rule only understands HTTP and cannot automatically proxy an OpenVPN connection.
Use this pattern only when you have a tested design for the exact OpenVPN mode and front-end software. The canonical Access Server forwarding approach is easier to support for Access Server installations; generic stream-proxy configurations vary by operating system, TLS termination model and client requirements. Document which component owns certificates, where encryption ends, and how health checks distinguish a browser from a VPN client.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Why UDP is normally the better OpenVPN transport
OpenVPN documentation states that it works best over UDP. UDP avoids the nested retransmission and congestion-control behavior that can occur when a reliable VPN stream is carried inside another reliable TCP stream. Running OpenVPN over TCP can therefore create TCP-over-TCP performance problems, especially on lossy or congested links. There is no universal throughput figure for this deployment; performance depends on the path, encryption settings, VPS resources and workload.
TCP 443 remains valuable as a compatibility fallback because restrictive networks commonly allow HTTPS traffic. Treat it as a reachability option. Offer UDP first when the client network permits it, and use TCP 443 only where the fallback is necessary.
Validation checklist for a production change
- Socket ownership: One expected process owns TCP 443; the VPN owns the selected UDP port, or Access Server owns TCP 443 when forwarding is intentional.
- DNS: Every public hostname resolves to the correct VPS address, including any IPv6 record you publish.
- TLS: The certificate covers the requested hostname, the key path is correct, and the actual TLS terminator—not the VPN backend—serves the certificate.
- Firewall: Security groups and host rules allow only the selected TCP and UDP ports.
- Profiles: Client configurations contain the current hostname, protocol and port.
- Functional tests: HTTPS browsing, VPN authentication, address assignment and required private routes all work from outside the VPS network.
- Recovery: You have console access or an out-of-band management path before changing a listener that could lock you out.
Troubleshooting by symptom
The browser shows the OpenVPN portal instead of the website
TCP 443 is being handled by Access Server or its forwarding rule is sending browser traffic to the Access Server web service. Check which process owns the socket, confirm the web service’s internal port (commonly 943), and correct the forwarding destination. If you intended the simple layout, stop trying to share TCP 443 and move OpenVPN to UDP 1194.
Free tools Windows power users keep installed
One-click scans. No signup required.
The website will not start after enabling OpenVPN TCP
Both services are attempting to bind TCP 443. Choose one owner. Keep Nginx or Apache on TCP 443 and move OpenVPN to UDP, or let Access Server own TCP 443 and use its supported forwarding design. Restarting either service repeatedly will not resolve a socket collision.
VPN clients stopped connecting after a port or interface change
Compare the client profile with the server’s current public hostname, protocol, port and listening interface. Regenerate or redistribute profiles when those values changed, and confirm the corresponding firewall and security-group rule is open. Existing profiles do not automatically learn a new endpoint.
HTTPS reports a certificate or hostname error
Verify that DNS points to the intended VPS and that the process terminating TLS on TCP 443 has the certificate and private-key paths for the requested hostname. In a forwarding design, make sure the request reaches the component expected to terminate TLS; a certificate installed only on a backend that never sees the TLS handshake cannot fix the public error.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
OpenVPN connects, but performance is poor over TCP
Where the network allows it, switch clients to the UDP profile and keep the TCP profile as a fallback. Avoid claiming a fixed speed improvement: the available evidence establishes the TCP-over-TCP risk qualitatively, not a universal benchmark.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The service works locally but not from the Internet
Check the VPS provider’s security group, host firewall, public DNS, IPv4/IPv6 routing and whether the service is bound only to loopback. A local curl or VPN test proves only that the daemon is running; it does not prove that the public address and upstream firewall permit the connection.
Operational practices that prevent repeat outages
Keep a port map
Record the public listeners, internal forwarding ports, owning processes, certificate locations and firewall rules. For example: website TCP 443 to Nginx; optional HTTP TCP 80 redirect; OpenVPN UDP 1194; Access Server web UI TCP 943 when that product is used. Update the map whenever a service or hostname changes.
Separate administrative access from public traffic
Use a management interface, restricted source addresses or a separate access path for SSH and administration. Publicly exposing only the website and the required VPN endpoint reduces the number of attack surfaces and makes firewall reviews simpler.
Change one boundary at a time
Do not simultaneously change DNS, certificates, OpenVPN protocol, listener interface and firewall rules. Change one layer, test it externally, then continue. Keep a rollback configuration and an active VPN or console session while editing remote listeners.
Monitor both protocols
HTTP health checks should test the expected website and certificate name. VPN monitoring should verify that the UDP or TCP listener is reachable and that authentication succeeds with a test profile. A green HTTP check cannot prove that OpenVPN is reachable, and a reachable VPN port cannot prove that HTTPS forwarding is correct.
Recommended decision
Use Nginx or Apache on TCP 443 and OpenVPN on UDP 1194 for the default, stable deployment. This respects the one-process-per-socket rule and OpenVPN’s UDP preference. If a restrictive network forces VPN traffic through TCP 443, let OpenVPN Access Server own that socket and configure its service forwarding to the web UI or to a separate Nginx/Apache backend. Do not launch two unrelated TCP daemons and expect them to share the port; the listener and forwarding design must be explicit.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
