Port 51820 WireGuard · UDP

What runs on port 51820

WireGuard's conventional UDP port (it has no fixed default; 51820 is what every guide uses). WireGuard does not respond to packets that do not carry a valid key, so the port is invisible to scanners; it is also stateless, so it needs UDP open in one direction only and survives roaming between networks. The fastest and simplest VPN protocol available today; Tailscale, Mullvad, NetBird and most router firmware are built on it.

Software that uses it: WireGuard (kernel and wireguard-go) · Tailscale, NetBird, Netmaker · pfSense/OPNsense, OpenWrt, MikroTik · Mullvad, Proton and other commercial VPNs

Should port 51820 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• wg show on the server: a peer with a recent "latest handshake" is connected; no handshake means the key, endpoint or UDP port is wrong.
• PersistentKeepalive = 25 on clients behind NAT keeps the mapping alive.

Check port 51820

# on the host: is anything listening, and which process?
ss -lunp 'sport = :51820'
sudo lsof -i :51820

# from another machine: is it reachable?
nc -zuv host 51820
sudo nmap -sU -p 51820 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 51820

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 51820 proto udp
sudo ufw deny 51820/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 51820 accept
nft add rule inet filter input udp dport 51820 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 51820 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 51820 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=51820 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 51820" with no source is just "open".

Related ports

• 1194 OpenVPN
• 500 IKE — IPsec key exchange
• 4500 IPsec NAT-T — IKE/ESP when behind NAT

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions