Port reference
Port 1701 (UDP) – L2TP (VPN)
Layer 2 Tunneling Protocol — tunnels PPP for VPNs, typically wrapped in IPsec for encryption.
Quick facts
- Transport
- udp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on VPN concentrators, routers, and firewalls offering L2TP/IPsec remote access, usually alongside IKE on 500/4500.
What is port 1701 used for?
Port 1701 is the Layer 2 Tunneling Protocol (L2TP), used to build VPN tunnels. It's the protocol behind the built-in "L2TP/IPsec" VPN client in Windows, macOS, iOS, and Android, and is offered by many routers and firewalls for remote access. L2TP only tunnels traffic; it carries no encryption itself, so it's almost always paired with IPsec, whose key exchange runs on UDP 500 and 4500.
When would you open it?
Open or forward UDP 1701 (along with 500 and 4500) on a router or VPN gateway when you want remote users to dial in with the operating system's built-in L2TP/IPsec client. You only need it if you're hosting the VPN endpoint yourself.
Is it safe to open?
L2TP is safe only when wrapped in IPsec with a strong pre-shared key or certificates; never run L2TP alone, and prefer IKEv2 with MFA on logins. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1701
nmap -sU -p 1701 <target>netstat -ano | findstr :1701
Test-NetConnection <host> -Port 1701 # TCP onlylsof -i :1701
nmap -sU -p 1701 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1701 to your device's local IP, internal port 1701, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1701/udpsudo firewall-cmd --permanent --add-port=1701/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 1701 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1701" -Direction Inbound -Protocol UDP -LocalPort 1701 -Action AllowSecurity & risks
Common attacks
- Offline cracking of weak IPsec pre-shared keys (PSK)
- Aggressive-mode IKE PSK hash capture
- Unencrypted L2TP traffic when IPsec is absent
- Credential brute force against the PPP/VPN login
Hardening
- Always wrap L2TP in IPsec; never run L2TP alone
- Use strong, unique PSKs or move to certificate auth
- Disable IKE aggressive mode; prefer IKEv2
- Enforce MFA on VPN logins and lock out brute force
- Restrict access and keep the VPN appliance patched
How to block this port
sudo ufw deny 1701/udpsudo firewall-cmd --permanent --remove-port=1701/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 1701 -j DROPNew-NetFirewallRule -DisplayName "Block 1701" -Direction Inbound -Protocol UDP -LocalPort 1701 -Action Blocknmap snippet
nmap -sU -p1701 --script l2tp-version <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does L2TP encrypt traffic on its own?
- No. L2TP only tunnels; it provides no confidentiality. It is paired with IPsec (L2TP/IPsec) on ports 500/4500 for the actual encryption. L2TP alone is plaintext.
- Is L2TP/IPsec secure?
- It can be, with a strong pre-shared key or certificate auth, IKEv2, and aggressive mode disabled. Weak PSKs are crackable offline, so prefer certificates and MFA.