Common attacks and weaknesses
- Same exposure as the IKE gateway on 500.
Port 4500: IPsec NAT-T
IPsec traffic encapsulated in UDP to cross NAT.
4500
How IPsec NAT-T works
VPN, tunnels & proxiesTraffic is wrapped in a tunnel between the two ends, so the network in between only sees the tunnel. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- UDP · TCP
- Exposure risk
- 3/10 moderate if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- VPN, tunnels & proxies
Is port 4500 dangerous?
How to secure it
- Patch the VPN gateway and use strong authentication.
IANA registry entries for port 4500
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| ipsec-nat-t | 4500 | TCP, UDP | IPsec NAT-Traversal | RFC 9329 | 2022-09-15 |
// source: IANA service name and port number registry
Which program uses port 4500, and is it reachable?
Linux
sudo ss -ltnup 'sport = :4500' # process listening on 4500
sudo lsof -nP -i :4500macOS
sudo lsof -nP -i :4500
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 4500 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 4500 netstat -ano | findstr :4500
From another machine
nmap -p 4500 -sV <host> sudo nmap -sU -p 4500 <host> nc -zv <host> 4500
Block it in the firewall
sudo ufw deny 4500/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 4500" -Direction Inbound -LocalPort 4500 -Protocol TCP -Action Block # Windows
What is port 4500 used for?
IPsec traffic encapsulated in UDP to cross NAT.
Is port 4500 TCP or UDP?
Port 4500 is registered for UDP and TCP. In practice the service mostly uses UDP.
Is it safe to open port 4500?
It is rated 3/10 (moderate) when exposed to the Internet. Same exposure as the IKE gateway on 500. Patch the VPN gateway and use strong authentication.
How do I check if port 4500 is open?
On Linux run "ss -ltnup 'sport = :4500'", on macOS "lsof -nP -i :4500", and on Windows "netstat -ano | findstr :4500" to see the local process. From another machine, "nmap -p 4500 <host>" shows whether it is reachable.