DevToolsmith

Port 51820: WireGuard

Port 51820 (UDP) is the default port for WireGuard VPNs. It is in the dynamic range (49152–65535), which operating systems also use for outgoing connections.

Service
WireGuard
Protocol
UDP
Range
Dynamic (49152–65535)
Official
Common convention
Exposure
Meant to be public
Category
Remote access

What uses port 51820

WireGuard is a modern, fast VPN built into the Linux kernel and used by Tailscale, Mullvad and many others. It only listens on a UDP port, 51820 by convention, and silently ignores packets that aren’t from a known peer key, so port scans can’t even tell it is there.

Should port 51820 be open to the internet?

Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.

  • Peers that are behind NAT and only receive traffic need PersistentKeepalive = 25 so the NAT mapping stays open.

Check what is listening on port 51820

Linux
sudo ss -lunp 'sport = :51820'
macOS
sudo lsof -nP -iUDP:51820
Windows (PowerShell)
Get-NetUDPEndpoint -LocalPort 51820
netstat -ano | findstr :51820

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Open port 51820 in the firewall

Ubuntu / Debian (ufw)
sudo ufw allow 51820/udp
# Close it again:
sudo ufw delete allow 51820/udp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "WireGuard 51820/UDP" -Direction Inbound -Protocol UDP -LocalPort 51820 -Action Allow

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 51820 with Docker

Docker
docker run -d -p 51820:51820/udp linuxserver/wireguard

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 51820 from another machine

macOS / Linux
nc -zvu example.com 51820   # UDP has no handshake, so "open" isn't conclusive

Related ports

  • Port 1194 (OpenVPN): the default port for OpenVPN.
  • Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.

More remote access ports

23 (Telnet) , 2222 (SSH (alternate)) , 3389 (RDP) , 5900 (VNC) , 5985 (WinRM (HTTP)) , 5986 (WinRM (HTTPS)) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 51820 used for?

Port 51820 is the default port for WireGuard VPNs. WireGuard is a modern, fast VPN built into the Linux kernel and used by Tailscale, Mullvad and many others. It only listens on a UDP port, 51820 by convention, and silently ignores packets that aren’t from a known peer key, so port scans can’t even tell it is there.

Is it safe to open port 51820?

This port is meant to be reachable by clients on the internet when you run this service publicly. Keep the service behind it up to date and require authentication where it applies.

How do I check if port 51820 is open?

On the server, list listening sockets with "sudo ss -lunp 'sport = :51820'" on Linux or "sudo lsof -nP -i :51820" on macOS. From another machine, UDP has no handshake, so a port scan can’t reliably tell whether it is open; test with a real client for the service instead.