L2TP normally uses UDP 1701, while IPsec uses UDP 500 and UDP 4500 for NAT traversal. PPTP needs TCP 1723 plus GRE traffic. OpenVPN and WireGuard use the port configured on the server, so check that setting before adding a router rule.
These checks are mainly for a VPN server you run. If you are connecting to a commercial VPN or a workplace server as a client, you usually do not need to forward inbound ports on your home router.
VPN port and protocol table
| VPN type | Port or IP protocol | What to check |
|---|---|---|
| L2TP | UDP 1701 | L2TP alone does not encrypt the tunnel; it is commonly protected with IPsec. |
| L2TP/IPsec or IKE/IPsec | UDP 500; UDP 4500 for NAT traversal | Follow the server’s rules for IPsec and the protected L2TP traffic. Native ESP is IP protocol 50 where needed. |
| PPTP | TCP 1723 plus GRE, IP protocol 47 | Opening TCP 1723 alone is not enough. PPTP is a legacy choice to avoid for a new secure setup. |
| OpenVPN | Often UDP 1194; configurable UDP or TCP | The client and server must agree on the port and transport. |
| WireGuard | UDP; 51820 is a common example, not a mandatory port | Use the configured ListenPort and matching client endpoint. |
GRE 47 and ESP 50 are IP protocol numbers, not TCP or UDP ports. A port-forwarding form with only a port-number box cannot always handle them.
Is the L2TP port TCP or UDP?
For the usual L2TP-over-IP setup, it is UDP 1701. The older version of this guide incorrectly called it TCP. The L2TP specification describes the UDP transport, and the L2TP/IPsec specification explains its protection.
With L2TP/IPsec, do not treat a public rule for unprotected UDP 1701 as the whole setup. The outer IPsec connection uses its own rules. Cisco Meraki’s client-VPN guidance, for example, checks UDP 500 and 4500 at the upstream router. Use your own server’s instructions.
Which ports does OpenVPN Access Server use?
Access Server’s documented defaults are UDP 1194 and TCP 443 for VPN connections. Its web services also use TCP 943, with sharing and configuration details that depend on the setup. Do not expose an admin interface just because it appears in a port list.
For WireGuard, the project’s quick start shows a configurable UDP listen port. Forwarding TCP 51820 will not match a server listening on UDP 51820.
Before opening a port on your router
- Check the actual server port and whether it uses TCP or UDP.
- Give the server a stable local address, such as a DHCP reservation.
- Allow the matching connection in the server’s firewall.
- If the server is behind a router, forward only the needed traffic to that server.
- If the VPN runs on the router itself, use its VPN and firewall settings rather than forwarding the same port to another PC.
- Test from another network, such as a mobile connection, and read the VPN’s error or handshake status.
Find the correct equipment guide with your router’s brand and model. If it still fails, check double NAT, provider-side NAT, the public address, authentication and server logs. Dynamic DNS can keep a name pointed at a changing address; it does not create a reachable public connection by itself.
Updated October 14, 2026. Instructions and available features can vary by device, account and software version.