Running VPN server and Apache conflicting ports

Question

Currently my setup is with XAMPP and a simple VPN server provided by Windows Network connections.

If I delete the Incoming Connections, start apache and then remake the VPN server like this:

It works fine (both the VPN and apache).

I already know that I can change Apache to run on different ports but I do not wish to do that. Is there anyway I can stop system from using port 443?

So maybe it's not in my best interest to change the port of the VPN server either.

I want to run both my apache and VPN at the same time, any recommendations?

Answer 1

The problem is that Windows 7 tries to accept incoming VPN connections using all protocol it could support, and this includes SSTP (Secure Socket Tunneling Protocol). SSTP is basically PPP tunneled over SSL, and by default it uses the same port 443 as usual HTTPS connections. Such usage of port 443 allows SSTP to pass through many HTTP proxies which allow connecting to HTTPS servers. Unfortunately, this also means that it will conflict with running an HTTPS server on the same machine as the SSTP VPN server — unless the HTTPS server is Microsoft IIS, which uses the same http.sys kernel driver as the SSTP server to process HTTP and HTTPS requests.

Note that incoming SSTP connections will most likely fail, because your machine probably does not have an appropriate server certificate to accept them. You would probably see RasSstp/18 warning events in the System event log informing about these problems. However, this does not stop the system from occupying the port 443, even if SSTP client connections to it will actually fail.

There are some useful articles about SSTP in the Routing and Remote Access Blog. However, I have not been able to find a method to disable SSTP usage just for the VPN server. It is possible to disable the ”WAN Miniport (SSTP)” device in the Device Manager (after enabling the “Show Hidden Devices” option), however, this could also affect outgoing VPN connections from the same machine.

But there is an article about SSTP server configuration, and also KB947054, which describe a way to change the port used by the SSTP server to accept incoming connections. Using a registry editor, find the following subkey:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Sstpsvc\Parameters

Then set the ListenerPort DWORD value to the port number which should be used for incoming SSTP connections. Be sure to specify it as a decimal value (by default the “Hex” radio button is selected). Select a port which will not conflict with other ports used by the system or your applications.

To apply the new setting, restart the “Routing and Remote Access” service. Check the output of the netstat -aon command to confirm that the newly specified port is now in use, and the port 443 is no longer used.

Answer 2

This is an old question but I want to add some other options.

The advantage of both of these is that you can still keep using SSTP on port 443. This is especially useful because this port is open in most company, hotel, hotspot, ... firewalls, allowing you set up a VPN connection where PPTP/IPSec/... would fail.

Use IIS instead of Apache

You can run mostly anything (like PHP) on IIS that also runs on Apache.

You can use the Microsoft Web Platform Installer to set this up for you: http://www.microsoft.com/web/downloads/platform.aspx From there you can install all kinds of frameworks.

If you want PHP specifically (this just launches Web Platform Installer with PHP preselected): http://www.microsoft.com/web/platform/phponwindows.aspx

This will also be a lot faster on Windows than Apache.

Apache fronted by IIS as reverse proxy

Let IIS listen on port 443 (SSL offloading) and forward to Apache (on port 80 or something else).

Look for "IIS reverse proxy" on Google. Your options are URL rewriting or Application Request Routing (ARR).

Some web applications might have to be specifically configured to work behind a reverse proxy because the incoming URL will be modified by the proxy.

Answer 3

I have created a VBS file to quickly change the port of the SSTP.

If WScript.Arguments.length = 0 Then
    Set ObjShell = CreateObject("Shell.Application")
    ObjShell.ShellExecute "wscript.exe", """" & WScript.ScriptFullName & """" & " RunAsAdministrator",, "runas", 1
    WScript.Quit
End If

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

strValue = InputBox("Desired new port for SSTP:")
objRegistry.SetDWORDValue &H80000002, "SYSTEM\CurrentControlSet\services\SstpSvc\Parameters", "ListenerPort", strValue
MsgBox "SSTP ListenerPort has been changed to " & strValue & "."

Copy and paste this into a new text document and change the extension to .vbs.

You can also download this script here.

After the port has been changed you will need to go to the command prompt as an administator (create a cmd.exe shortcut and run as an administrator). Then enter these two commands:

net stop "routing and remote access"
net start "routing and remote access"