Port 500 (IKE (IPsec))

Internet Key Exchange for IPsec VPNs (site-to-site tunnels, strongSwan, Windows and macOS built-in VPN clients).

Well-known (system) port, 0-1023 UDP VPN Meant to face the internet

Port 500 is normally used over UDP; the checker tests TCP only, so a "filtered" result does not mean the UDP service is down.

What port 500 is used for

Internet Key Exchange for IPsec VPNs (site-to-site tunnels, strongSwan, Windows and macOS built-in VPN clients).

Security: should port 500 be open?

Meant to face the internet. Required on VPN gateways. Disable IKEv1 aggressive mode with pre-shared keys (leaks a crackable hash) and prefer IKEv2 with certificates.

IANA assignment

Service nameProtoDescriptionAssigneeReference

isakmp TCP isakmp Mark Schertler -

isakmp UDP isakmp Mark Schertler -

Check what is listening on port 500

Linux: UDP 500

sudo ss -ulnp 'sport = :500'

Linux / macOS: which process owns the port

sudo lsof -nP -i :500

Windows (Command Prompt)

netstat -ano | findstr :500

Windows (PowerShell)

Get-NetUDPEndpoint -LocalPort 500

Test it from outside

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 500

Open port 500 in the firewall

ufw

sudo ufw allow 500/udp

iptables

sudo iptables -A INPUT -p udp --dport 500 -j ACCEPT

nftables

sudo nft add rule inet filter input udp dport 500 accept

Windows Firewall

New-NetFirewallRule -DisplayName 'Allow UDP 500' -Direction Inbound -Protocol UDP -LocalPort 500 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.