When connecting to a remote server (e.g. via SSH) via a VPN, is the port-number used for the connection visible in traffic intercepted in between the client and VPN server?

Would connecting via Tor (instead/in-addition) help this?

  • The IP Address and the TCP/UDP port of VPN server to which you are connected to is visible in payload. Your ISP can also block that port to forbid you using VPN services. OpenVPN uses port 1194 for UDP. Blocking this port will prevent you from connecting to it.
    – defalt
    Feb 21 '17 at 4:39

(I'm mostly referring to OpenVPN here.)

When connecting to a remote server (e.g. via SSH) via a VPN, is the port-number used for the connection visible in traffic intercepted in between the client and VPN server?

No. Your ISP, room mate, or any other possible man-in-the-middle between you and the VPN (without the ability to decrypt the traffic) doesn't know anything about your connections within the VPN tunnel. They don't know which ports you're connected to or whether you're using the tunnel for SSH or to browse the web.1

That is, all of the tunneled traffic between you and the server is TLS-encrypted and sent over a single TCP/UDP connection. An eavesdropper can only observe that, for instance, there is encrypted traffic over UDP between your port 12345 and the VPN's port 1194 and they may therefore deduce that you are using OpenVPN (and eventually identify the VPN provider by the server IP), but they don't know not what you are doing. The VPN provider however is obviously able to read (and log) your traffic.

Would connecting via Tor (instead/in-addition) help this?

Yes, that would also work. If you tunneled your traffic through Tor you would similarly hide these connection details from a man-in-the-middle between your machine and the Tor network. However, they could tell that you're using Tor and the exit node would be able to inspect your tunneled traffic.

1Although they could try to find patterns in your traffic to get an idea what you might be doing.

  • But the IP and port of that VPN server is still visible in payload and this information can be used to identify and filter VPN connection. I think this is what the subject of question.
    – defalt
    Feb 21 '17 at 4:45
  • @defalt I don't think OP was asking about the VPN server's port (which I addressed, too).
    – Arminius
    Feb 21 '17 at 4:55

If I understand your question correctly you have this scenario:

Client --- VPN Server --- Remote Host

You are establishing a VPN tunnel between Client and VPN Server, but traffic leaving the VPN Server to the Remote Host does not use a VPN. If this is wrong please edit your question to add more info, and comment to let me know.

All TCP/IP packets include their destination port number. So anyone monitoring traffic between you and your VPN server could see the SSH destination port (e.g. 22 or whatever else it was changed to). Tor traffic works essentially the same way between you and the first relay node.

However, the destination port of any traffic you are tunneling over that VPN connection to Remote Host would not be visible to people monitoring the Client to VPN Server connection. Those packets are the encrypted payload of the VPN packets. From the perspective of the monitor everything would be heading to port 22 on the VPN Server. Again, Tor is essentially the same but has more encrypted hops between the Client and Remote Host.


No one will be able to see the destination port number in the original packet.

When you are using VPN the payload gets totally encrypted by the VPN technology and then the encrypted data is sent to the VPN server, where the decryption happens and then the payload is processed actually.

So suppose you are a home user and you are doing SSH to your company network over some VPN. All the ISP will know that you are using a VPN as VPNs have specific port numbers. But when the encrypted data reaches the VPN server, it processes the data and forwards the SSH request. Only if you tap the connection between the VPN server and the endpoint where you want to SSH, you can see the actual data.

Suppose your ISP blocks the VPN connection based on the VPN, so you can use TOR and over that use a VPN and then do the SSH. This way you will have the max security.

I hope this helps you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.