Port 4500 IPsec NAT-T · UDP

What runs on port 4500

IPsec NAT traversal (NAT-T): when a NAT is detected during IKE on port 500, both the IKE exchange and the ESP packets move to UDP 4500, wrapped in UDP so NAT devices can track them. Mobile and home clients are almost always behind NAT, so a VPN server without 4500 open works only from the office.

Software that uses it: strongSwan · Libreswan · Cisco, Fortinet, Palo Alto · Windows/macOS/iOS/Android native VPN clients

Should port 4500 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Open UDP 500 and 4500 together; forget 4500 and road warriors fail after the first handshake.

Check port 4500

# on the host: is anything listening, and which process?
ss -lunp 'sport = :4500'
sudo lsof -i :4500

# from another machine: is it reachable?
nc -zuv host 4500
sudo nmap -sU -p 4500 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 4500

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 4500 proto udp
sudo ufw deny 4500/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 4500 accept
nft add rule inet filter input udp dport 4500 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 4500 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=4500 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 4500" with no source is just "open".

Related ports

• 500 IKE — IPsec key exchange
• 1194 OpenVPN
• 51820 WireGuard

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions