Does VPN use own, dedicated Ports? Or does the encrypted traffic just go through 443?

Question

Let's say I use the OpenVPN protocol encrypt my network traffic. What port does the VPN use?

Does the encrypted traffic just go through 443 or 80? (HTTPS/HTTP)

or does the VPN create use its own port to send packages?

Answer 1

Depends – there is a ton of protocols for implementing a VPN, both standard and proprietary. Some of them deliberately use port 443 (often masquerading as TLS), but most of them do not.

Note that only some VPN protocols use TCP at all – the majority use either UDP (which has its own ports separate from TCP) or something else such as GRE, as tunnelling TCP/IP inside another TCP is generally something to be avoided.

OpenVPN is a commonly used protocol that supports being used over either TCP or UDP, and its officially assigned port is 1194 but the server owner is free to choose something else. So while UDP/1194 is the default choice, many people actually run OpenVPN servers on TCP/443 so that they could pass through restrictive firewalls on public wifi networks.

Some other protocols use UDP exclusively, such as WireGuard (which doesn't have a "standard" port – the server operator has to choose one.)

There are also hybrid protocols which use TCP for the "control" connection, but UDP for the data channel. One such example is the OpenConnect / Cisco AnyConnect protocol, which uses regular HTTPS (usually on port 443) for the initial handshake before moving to DTLS over UDP (though also commonly on port 443) – although it can be configured to send all data over TCP as well, and would run entirely over TCP/443 if UDP is unavailable.

(Similarly, PPTP uses TCP port 1723 for its control channel but GRE for the actual tunnel – GRE is neither TCP nor UDP, and doesn't even have ports the same way TCP/UDP do.)