Common attacks and weaknesses
- IKEv1 aggressive mode leaking crackable pre-shared key hashes.
- VPN gateway vulnerabilities.
Port 500: IKE (IPsec)
Internet Key Exchange for IPsec VPNs (NAT traversal uses UDP 4500).
500
How IKE (IPsec) works
VPN, tunnels & proxiesTraffic is wrapped in a tunnel between the two ends, so the network in between only sees the tunnel. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- UDP · TCP
- Exposure risk
- 4/10 moderate if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- VPN, tunnels & proxies
Is port 500 dangerous?
How to secure it
- Use IKEv2 with certificates.
- Disable aggressive mode and patch gateways.
IANA registry entries for port 500
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| isakmp | 500 | TCP, UDP | isakmp | - | - |
// source: IANA service name and port number registry
Which program uses port 500, and is it reachable?
Linux
sudo ss -ltnup 'sport = :500' # process listening on 500
sudo lsof -nP -i :500macOS
sudo lsof -nP -i :500
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 500 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 500 netstat -ano | findstr :500
From another machine
nmap -p 500 -sV <host> sudo nmap -sU -p 500 <host> nc -zv <host> 500
Block it in the firewall
sudo ufw deny 500/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 500" -Direction Inbound -LocalPort 500 -Protocol TCP -Action Block # Windows
What is port 500 used for?
Internet Key Exchange for IPsec VPNs (NAT traversal uses UDP 4500).
Is port 500 TCP or UDP?
Port 500 is registered for UDP and TCP. In practice the service mostly uses UDP.
Is it safe to open port 500?
It is rated 4/10 (moderate) when exposed to the Internet. IKEv1 aggressive mode leaking crackable pre-shared key hashes. Use IKEv2 with certificates.
How do I check if port 500 is open?
On Linux run "ss -ltnup 'sport = :500'", on macOS "lsof -nP -i :500", and on Windows "netstat -ano | findstr :500" to see the local process. From another machine, "nmap -p 500 <host>" shows whether it is reachable.