Re: server: listening on two ports at the same time

Jan Just Keijser <[email protected]> Thu, 19 Mar 2026 17:53:13 +0100
Newsgroups gmane.network.openvpn.user
Message-ID <[email protected]> 
This is a multi-part message in MIME format.
--===============1782599937811911966==
Content-Type: multipart/alternative;
 boundary="------------ltuyHSae39d0B5w8k3i6jW5R"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------ltuyHSae39d0B5w8k3i6jW5R
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hi Greg,

On 19/03/2026 17:32, Greg Troxel wrote:
> Gert Doering<[email protected]>  writes:
>
>> On Thu, Mar 19, 2026 at 10:12:53AM -0400, Greg Troxel wrote:
>>> I would also like the TLS connection from openvpn to appear to any
>>> networks in between just like web traffic, at least until you look at
>>> timing and data sizes.  I am finding that many wifi networks purportedly
>>> for customer convenience at businesses are blocking openvpn's udp/1194.
>> OpenVPN TCP is not "looks like web traffic TLS" and will never be.
> Thanks.  My wording was not careful enough.   I did not mean to ask to
> change the normal mode.   I was expressing that for me, one of the main
> uses is to be able to use a network when various things are blocked, and
> that I am frequently encountering not just filtering of 1194/udp, but
> apparently everything except 80/443.
>
> I would like to have a vpn server on machines that are already running
> nginx on 443.
>
> So therefore it would be nice if openvpn had a mode where it could
> connect via an nginx reverse proxy somehow, that did not demand a
> particular place in the web namespace, or to be primary on the port.
>
>> The feature request to "run openvpn via a https proxy" has been voiced
>> here and there, but nobody really felt like implementing it.
> Are you simply saying "nobody's done it yet" or is there some kind of
> philosophical or other objection to adding things  like that, for
> getting around blocking?
>
> Sooner or later I will be able to report back on how openvpn on just 443
> works in blocked networks.  I checked my notes and of 5 fairly-blocked
> networks, 4 of them blocked 1194/udp, and those 4 also blocked
> submission, imaps, xmpp, and Tor (over 443!).
>
>
the only way to technically achieve what you want (connect to openvpn 
via an https (nginx) connection) is if someone implements, as Gert says 
"run openvpn via a https proxy" .  And yes, it is just a matter of 
"nobody's done it yet".  A couple of years ago, when I had more time to 
involve myself with OpenVPN, I looked at it and decided it was 
non-trivial to implement in the codebase at that time.

JM2CW,

JJK

--------------ltuyHSae39d0B5w8k3i6jW5R
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">Hi Greg,<br>
      <br>
      On 19/03/2026 17:32, Greg Troxel wrote:<br>
    </div>
    <blockquote type="cite" cite="mid:[email protected]">
      <pre class="moz-quote-pre" wrap="">Gert Doering <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]">&lt;[email protected]&gt;</a> writes:

</pre>
      <blockquote type="cite">
        <pre class="moz-quote-pre" wrap="">On Thu, Mar 19, 2026 at 10:12:53AM -0400, Greg Troxel wrote:
</pre>
        <blockquote type="cite">
          <pre class="moz-quote-pre" wrap="">I would also like the TLS connection from openvpn to appear to any
networks in between just like web traffic, at least until you look at
timing and data sizes.  I am finding that many wifi networks purportedly
for customer convenience at businesses are blocking openvpn's udp/1194.
</pre>
        </blockquote>
        <pre class="moz-quote-pre" wrap="">
OpenVPN TCP is not "looks like web traffic TLS" and will never be.
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">
Thanks.  My wording was not careful enough.   I did not mean to ask to
change the normal mode.   I was expressing that for me, one of the main
uses is to be able to use a network when various things are blocked, and
that I am frequently encountering not just filtering of 1194/udp, but
apparently everything except 80/443.

I would like to have a vpn server on machines that are already running
nginx on 443.

So therefore it would be nice if openvpn had a mode where it could
connect via an nginx reverse proxy somehow, that did not demand a
particular place in the web namespace, or to be primary on the port.

</pre>
      <blockquote type="cite">
        <pre class="moz-quote-pre" wrap="">The feature request to "run openvpn via a https proxy" has been voiced
here and there, but nobody really felt like implementing it.
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">
Are you simply saying "nobody's done it yet" or is there some kind of
philosophical or other objection to adding things  like that, for
getting around blocking?

Sooner or later I will be able to report back on how openvpn on just 443
works in blocked networks.  I checked my notes and of 5 fairly-blocked
networks, 4 of them blocked 1194/udp, and those 4 also blocked
submission, imaps, xmpp, and Tor (over 443!).


</pre>
    </blockquote>
    the only way to technically achieve what you want (connect to
    openvpn via an https (nginx) connection) is if someone implements,
    as Gert says "run openvpn via a https proxy" .  And yes, it is just
    a matter of "nobody's done it yet".  A couple of years ago, when I
    had more time to involve myself with OpenVPN, I looked at it and
    decided it was non-trivial to implement in the codebase at that
    time.<br>
    <br>
    JM2CW,<br>
    <br>
    JJK<br>
    <br>
  </body>
</html>

--------------ltuyHSae39d0B5w8k3i6jW5R--


--===============1782599937811911966==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1782599937811911966==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users

--===============1782599937811911966==--