Port 51820 (WireGuard)
Port 51820 is the port WireGuard uses in its own examples (ListenPort = 51820), so most WireGuard VPN servers and guides use it. It is not registered with IANA, and any other UDP port works just as well.
- Service
- WireGuard
- Protocol
- UDPUDP only. WireGuard has no TCP mode, so TCP tests, including ours, cannot show whether it is reachable.
- IANA registry
- Not assigned. The use described here is unofficial.
- Commonly used by
Check if a port is open on your IP
UDP only. WireGuard has no TCP mode, so TCP tests, including ours, cannot show whether it is reachable.
Is it safe to open port 51820?
WireGuard stays silent to packets that are not signed with a known key, so an open 51820 reveals little. Protect the private keys, give each peer only the AllowedIPs it needs, and keep the software updated.
“Port 51820 is already in use”: how to fix it
The error means another program is already listening on port 51820. Find its process ID (PID), then stop that program or start yours on a different port.
Windows (Command Prompt or PowerShell as administrator)
netstat -ano | findstr :51820taskkill /PID <PID> /FmacOS
lsof -nP -iTCP:51820 -sTCP:LISTENkill <PID>Linux
sudo ss -ltnp | grep :51820sudo lsof -i :51820sudo kill <PID>Replace <PID> with the number from the last column (Windows) or the PID column (macOS, Linux).
How to open port 51820
Router: in the router’s admin page find Port Forwarding (sometimes Virtual Server or NAT), forward UDP port 51820 to the local IP of the computer running the service, and save.
Windows Defender Firewall (PowerShell as administrator)
New-NetFirewallRule -DisplayName "Port 51820 UDP" -Direction Inbound -Action Allow -Protocol UDP -LocalPort 51820Linux with ufw
sudo ufw allow 51820/udpLinux with firewalld
sudo firewall-cmd --permanent --add-port=51820/udpsudo firewall-cmd --reloadThen run the check above. If the port is still closed, see why a port can look closed below.
Why a port can look closed when your server is running
Most home networks sit behind a router doing NAT: the router owns the public address, and your computer has a private one such as 192.168.1.10. A connection from the internet reaches the router and stops there unless you add a port forwarding rule to your computer.
Many mobile and some home providers go further and use carrier-grade NAT (CGNAT): several customers share one public address, and your router itself gets an address from 100.64.0.0/10. Then no rule on your side can open a port; ask the provider for a public IP or use a tunnel or VPN service.
Even with forwarding in place, the firewall on the computer (Windows Defender Firewall, ufw, firewalld) must allow the port, and the program must listen on all interfaces (0.0.0.0), not only on 127.0.0.1.
UDP cannot be checked this way: a UDP service usually stays silent to packets it does not understand, so “no answer” means nothing. This check uses TCP only.
Frequently asked questions
What is port 51820 used for?
Port 51820 is the port WireGuard uses in its own examples (ListenPort = 51820), so most WireGuard VPN servers and guides use it. It is not registered with IANA, and any other UDP port works just as well.
Is port 51820 TCP or UDP?
UDP only. WireGuard has no TCP mode, so TCP tests, including ours, cannot show whether it is reachable.
Is it safe to open port 51820?
WireGuard stays silent to packets that are not signed with a known key, so an open 51820 reveals little. Protect the private keys, give each peer only the AllowedIPs it needs, and keep the software updated.
How do I free port 51820 if it is already in use?
Find the process: on Windows run netstat -ano | findstr :51820 and stop it with taskkill /PID <pid> /F; on macOS or Linux run lsof -i :51820 and stop it with kill <pid>.