Port 500 — UDP
UDP port 500 carries IKE negotiation for IPsec VPN tunnels. If address translation is present, the peers may subsequently use NAT-T on UDP 4500. Check both stages when troubleshooting a VPN.
What is port 500 used for?
IKE negotiates security parameters and authenticates IPsec peers. When NAT is detected, peers commonly move to UDP 4500 for NAT Traversal. A tunnel can therefore start on 500 and depend on 4500 for subsequent negotiation and encapsulated IPsec traffic.
Inspect both peers' identities, cryptographic proposals, authentication and selectors rather than relying on a port status alone.
Transport protocol
UDP
Security precautions
Often used with UDP 4500 for NAT-T. Restrict access according to authorized VPN peers.
Should we open this port in the firewall?
An Internet-facing site-to-site or remote-access VPN may need IKE on UDP 500. Restrict known peers where possible, use suitable cryptographic suites, protect credentials and certificates and log failures. Do not open 500/4500 across unrelated internal segments without an identified VPN requirement.
How do I check this port?
Reproduce tunnel establishment while inspecting IKE logs on both peers. A capture filtered on udp port 500 or udp port 4500 can show whether packets arrive and whether NAT-T occurs. Test-NetConnection -Port tests TCP and does not validate UDP 500.
- Check the expected public addresses and network path for both peers.
- Compare IKE versions, proposals, DH groups and authentication.
- Verify peer identities and the required certificates or pre-shared keys.
- If NAT is present, also check UDP 4500 and intermediate translations.
FAQ — port 500 / IKE / IPsec
Why does UDP 500 traffic pass while the IPsec tunnel still fails?
IKE can fail because of incompatible proposals, authentication, identities or certificates even when UDP 500 packets reach the peer.
How are ports 500 and 4500 related?
UDP 500 carries IKE; when NAT is detected, NAT-T commonly uses UDP 4500 for subsequent tunnel exchanges.
Should UDP 500 be allowed from the Internet?
Yes, when a remote VPN peer needs to reach the gateway. Keep the rule aligned with the VPN design and expected peers.