Port 51820 (WireGuard)

Conventional default listen port for WireGuard (wg-quick examples, Tailscale and many routers use other ports). Not an IANA assignment; it is in the dynamic range.

Dynamic / private (ephemeral) port, 49152-65535 UDP VPN Meant to face the internet

Port 51820 is normally used over UDP; the checker tests TCP only, so a "filtered" result does not mean the UDP service is down.

What port 51820 is used for

Conventional default listen port for WireGuard (wg-quick examples, Tailscale and many routers use other ports). Not an IANA assignment; it is in the dynamic range.

Security: should port 51820 be open?

Meant to face the internet. Safe to expose: WireGuard does not answer packets that are not signed with a known peer key, so port scans see nothing. The port only needs to be open on the side that receives connections.

IANA assignment

Port 51820 is in the dynamic range, which IANA never assigns. The usage above is unofficial but widespread.

Check what is listening on port 51820

Linux: UDP 51820

sudo ss -ulnp 'sport = :51820'

Linux / macOS: which process owns the port

sudo lsof -nP -i :51820

Windows (Command Prompt)

netstat -ano | findstr :51820

Windows (PowerShell)

Get-NetUDPEndpoint -LocalPort 51820

Test it from outside

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 51820

Open port 51820 in the firewall

ufw

sudo ufw allow 51820/udp

iptables

sudo iptables -A INPUT -p udp --dport 51820 -j ACCEPT

nftables

sudo nft add rule inet filter input udp dport 51820 accept

Windows Firewall

New-NetFirewallRule -DisplayName 'Allow UDP 51820' -Direction Inbound -Protocol UDP -LocalPort 51820 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.