Port 4500 (IPsec NAT traversal)

IKE and ESP encapsulated in UDP when either side of an IPsec tunnel is behind NAT.

Registered (user) port, 1024-49151 UDP VPN Meant to face the internet

Port 4500 is normally used over UDP; the checker tests TCP only, so a "filtered" result does not mean the UDP service is down.

What port 4500 is used for

IKE and ESP encapsulated in UDP when either side of an IPsec tunnel is behind NAT.

Meant to face the internet. Open it together with UDP 500 on IPsec gateways.

Service nameProtoDescriptionAssigneeReference

ipsec-nat-t TCP IPsec NAT-Traversal - RFC 9329

ipsec-nat-t UDP IPsec NAT-Traversal - RFC 3948, RFC 7296

Registry dates for this port: last modified 2022-09-15.

Linux: UDP 4500

sudo ss -ulnp 'sport = :4500'

Linux / macOS: which process owns the port

sudo lsof -nP -i :4500

Windows (Command Prompt)

netstat -ano | findstr :4500

Windows (PowerShell)

Get-NetUDPEndpoint -LocalPort 4500

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 4500

ufw

sudo ufw allow 4500/udp

iptables

sudo iptables -A INPUT -p udp --dport 4500 -j ACCEPT

nftables

sudo nft add rule inet filter input udp dport 4500 accept

Windows Firewall

New-NetFirewallRule -DisplayName 'Allow UDP 4500' -Direction Inbound -Protocol UDP -LocalPort 4500 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.