Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering if it is possible to redirect requests through Apache to eg. OpenVPN.
As long as I need to bypass firewall, I need to use port 80/443 for openVPN, but there is Apache server which has both port for itself.

Client ---> Firewall (allows 80/443 only) --->| ---> Apache (80/443) ---> OpenVPN (1194) |
                                                           My Server

I was thinking about mod_proxy, but I am not sure if it is good idea, have you got any ideas?
I hope possible solution will be applicable on virtual host as well.

share|improve this question
You need the client to connect to "My Server" for which service ? If it is HTTP/HTTPS you can use mod_proxy or re-write rule. Just have in mind that: or you do some NAT or you need to point the DFGW to the VPN server cause there will be asynchronous routing. Regards. – voodooo Jan 21 '11 at 13:26
@voodoo: I want to be able to have running apache on default ports (80.443) and running VPN Server (TCP) as well. Something like sslh ... – Ency Jan 21 '11 at 16:54
Why cant you open other tcp port at the firewall ? In this scenario you cant use mod_proxy nor rewrite rules. You need something listening on port 443 that can distinguish the https traffic and forward to apache and forward the rest to openvpn server. – voodooo Jan 21 '11 at 17:24
@voodoo: Because I cannot access firewall, it is not FW on "My server"'s side. Do you know any program which can separate Web traffic and the rest? Or maybe some apache module ... – Ency Jan 21 '11 at 17:26
Client ---> Firewall (allows 80/443 only) to Client ---> Firewall (allows 80/443/444 only) isn't this possible ? Noup, don't know such program.. – voodooo Jan 21 '11 at 17:31
up vote 1 down vote accepted

I used sslh. It works just great.

share|improve this answer

The issue - sharing ports - could be solved in the opposite direction, by making Apache listen on port, say, 10443 and forwarding requests from OpenVPN there with the port-share option. (via)

port 443
port-share localhost 10443
share|improve this answer

You can not use the same port for multiple services. So, you can keep apache running on one port 80 or 443 but not both. The other port can be used to forward requests to the openvpn server.

You can try port forwarding using SSH. Have a look at this link. You can forward the port 80 on the server to openVPN port. Of course, you need to change the port used by the openvpn client.

share|improve this answer
Well, I know I cant use one port for more apps, but on my webserver are used both protocols (HTTP, HTTPS). That is why I'm looking for something like apache proxy, mod_proxy seems good, but I do not think it is able to handle different protocol than http(s)/ftp. Tunnelling through SSH is not solution for me. – Ency Jan 21 '11 at 12:08

The simplest solution would be to get a second ip on the server and have OpenVPN listen to port 443 on that ip.

Don't forget, mod_proxy is for HTTP and HTTPS requests, and OpenVPN doesn't support either protocol as a transport.

Corkscrew will allow you to tunnel SSH over an SSL proxy. It could be used in conjunction with the SSH port forwarding that Khaled mentioned if getting an extra ip isn't an option.

share|improve this answer
I cannot get second IP, tunneling over ssh is user-unfriendly, so good for me, but not for my sister :) – Ency Jan 21 '11 at 12:58

The httptunnel package should help solve your problem. Source is available at

On the server:

  • run hts, redirected to openvpn (tcp) port.
  • hts -F openvpn-ip:1194 8888

You will need to set up a vhost with mod_proxy to port 8888

On the client:

  • run htc from an openvpn client
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.