Port reference
Port 500 (UDP) – IKE/ISAKMP
Internet Key Exchange — negotiates security associations and keys for IPsec VPN tunnels.
Quick facts
- Transport
- udp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on VPN gateways, firewalls, and routers terminating IPsec tunnels. Frequently exposed to the internet by design.
What is port 500 used for?
Port 500 carries IKE (Internet Key Exchange) over ISAKMP, the protocol that sets up IPsec VPN tunnels. It negotiates the encryption settings, authenticates both ends, and derives the keys before any encrypted traffic flows. You'll see it on VPN gateways, firewalls, and routers, including products like Cisco, Fortinet, pfSense, and the strongSwan and Libreswan daemons. When NAT is in the path, the session usually moves to UDP 4500.
When would you open it?
Open or forward UDP 500 when you run an IPsec VPN gateway and need remote clients or branch offices to connect. Site-to-site tunnels and remote-access VPNs both rely on it, often alongside UDP 4500. Only open it on the device that actually terminates the VPN.
Is it safe to open?
It's reasonable to expose if you use IKEv2 with strong authentication (certificates or long pre-shared keys) and keep firmware patched. See the security notes below.
How to check if this port is open
ss -tulpn | grep :500
nmap -sU -p 500 <target>netstat -ano | findstr :500
Test-NetConnection <host> -Port 500 # TCP onlylsof -i :500
nmap -sU -p 500 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 500 to your device's local IP, internal port 500, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 500/udpsudo firewall-cmd --permanent --add-port=500/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 500 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 500" -Direction Inbound -Protocol UDP -LocalPort 500 -Action AllowSecurity & risks
Common attacks
- Aggressive-mode PSK hash capture and offline cracking
- VPN gateway fingerprinting and enumeration (ike-scan)
- IKE DoS / resource exhaustion
Hardening
- Disable IKE aggressive mode; use main mode or IKEv2
- Prefer certificate auth over pre-shared keys, or use long random PSKs
- Restrict which peer IPs may initiate IKE where possible
- Patch VPN firmware promptly and enable DPD/rate limiting
How to block this port
sudo ufw deny 500/udpsudo firewall-cmd --permanent --remove-port=500/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 500 -j DROPNew-NetFirewallRule -DisplayName "Block 500" -Direction Inbound -Protocol UDP -LocalPort 500 -Action Blocknmap snippet
nmap -sU -p500 --script ike-version <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 500 used for?
- Port 500 carries IKE/ISAKMP, the protocol that negotiates keys and security associations for IPsec VPNs. NAT traversal then often moves traffic to UDP 4500.
- Why is IKE aggressive mode risky?
- Aggressive mode sends a hash of the pre-shared key in a way an attacker can capture and crack offline, so it should be disabled in favor of main mode or IKEv2.