Do you have to port forward when using OpenVPN?

Question

I'm going through an install of PiVPN (http://www.pivpn.io/) and it asks to specify a port. Some guides and videos say this needs to be forwarded from the router.

Isn't the point of a VPN to not have the need to port forward?

Answer 1

Short answer:

No, you do not have to use port forwarding, but a port number is still intrinsic to the process.

What?

Any and all IP network communication (read, anything that involves IPv4/6 addresses, hostnames, etc. -- ie., pretty much everything most people consider "networking") includes a port that is essentially part of the address in the same way that your street number is an essential part of your address.

[Technically that's not quite true, the port numbers are part of protocols used on top of IP 99.9%+ of the time, see comments below. It might be better to say it is like an apartment number, and an operating system is the apartment building. Stuff addressed only to the building is treated differently. OpenVPN isn't an operating system, it's an application, and as such has to have an apartment to be in the building.]

So: It is impossible to do much of anything on an IP network without using ports. There is no real alternative to this. You need the internet, and the internet uses port numbers.

That said, not you do not need to use port forwarding to use openVPN. What you need port forwarding for on your router is to allow incoming connections to a node inside your LAN.¹ LAN IP addresses are considered local; all the computers on your LAN use the same IP address externally. This does not require port forwarding because they can be distinguished by MAC address. That works because all the connections established between those computers and the outside world are initiated by the local computer, not the outside party, meaning the correct MAC address is associated with them. But if something outside your LAN wants to initiate a connection to something inside your LAN, it must to use the external router address, and, unless you've set up port forwarding, the router will not know what to do with that.

Alternately, if you use a VPN server outside your LAN, either one you set up yourself (~$5-10 USD a month depending on traffic, but this assumes technical expertise) or one you pay someone else to use (many VPN services are of this sort), then you don't need port forwarding. Your local computers connect to the VPN via that server (on the appropriate port).

If you don't want to use an external server, then you must have one inside the LAN. This is not much good outside the LAN, however, unless you can connect to it from there (the outside), which requires your router forward the traffic to the appropriate place, which is port number based, hence, port forwarding.

---

1. Which gets to your question, "Isn't the point of a VPN to not have the need to port forward?". Sort of. Once on the VPN you can connect to other nodes without port forwarding because every node on the VPN, like on a LAN, has a unique local address. That doesn't mean port numbers aren't still used -- they are -- but traffic does not have to be forwarded by a router as described in the next paragraph.