VPN Protocol Ports: WireGuard, OpenVPN, IPsec and VLESS

What a VPN protocol does, and where ports fit in

A VPN protocol is the rulebook for a tunnel. It defines how your device and the server prove who they are, agree on encryption keys, wrap your traffic in encrypted packets and keep the session alive when the network changes. WireGuard, OpenVPN and IKEv2 all do these jobs, with different cryptography and design trade-offs.

The port is where the server listens. Your device connects from a random source port, so on the client side you rarely need to think about ports. What matters is the server's port together with the transport:

• UDP sends independent datagrams with no delivery guarantee. Most modern VPN protocols prefer it, because the connections inside the tunnel already handle reliability.
• TCP delivers an ordered, reliable stream. It carries most ordinary web browsing and underpins VPN protocols built on TLS.
• IP protocol numbers are a third case. IPsec's ESP is not a TCP or UDP service at all but IP protocol 50, which is why IPsec firewall rules look different.

VPN protocol port reference table

These are the standard VPN ports you will meet in documentation and default configurations. They are conventions, not requirements: almost every protocol can listen on whatever port the operator chooses.

Providers often use other ports, so the port in your config file, key or link always takes priority over this table.

WireGuard and AmneziaWG ports

WireGuard runs over UDP only and has no IANA-registered port. The default WireGuard port, 51820, comes from the project's own examples, and most guides reuse it. On a server, the port is the ListenPort value in the [Interface] section. On your device, the server's address and port sit together in the Endpoint line of the [Peer] section, for example vpn.example.com:51820.

WireGuard stays silent when there is nothing to send, and routers usually drop idle UDP mappings much sooner than TCP ones. That is why configs often include PersistentKeepalive, a tiny packet sent at a fixed interval; the documentation suggests 25 seconds. When your device moves from Wi-Fi to mobile data, the server learns the new address from the next authenticated packet and the tunnel carries on.

Its speed reputation comes from the design: a codebase of a few thousand lines, a fixed set of modern primitives (Curve25519, ChaCha20-Poly1305, BLAKE2s) with no cipher negotiation, and an in-kernel implementation on Linux since version 5.6.

How AmneziaWG differs

AmneziaWG is based on WireGuard and also runs over UDP. It keeps WireGuard's cryptography and adds extra masking to its service packets, the messages that set up and maintain a session. Both ends must use matching masking parameters, so connections are distributed as ready-made configs or keys rather than typed in by hand.

There is no conventional AmneziaWG port; each server picks its own. With Flex-VPN, the key you import into the Amnezia VPN app already contains the address, port and parameters. For the config format and QR-code import, see What Is WireGuard?.

OpenVPN, IPsec/IKEv2 and L2TP ports

OpenVPN port

The OpenVPN port registered with IANA is 1194, and the classic setup listens on UDP 1194. OpenVPN can also run over TCP, and TCP 443, the standard HTTPS port, is a popular alternative. A typical server instance listens on one transport, so a provider offering both UDP and TCP usually runs two instances. OpenVPN has a long track record but generally carries more overhead than WireGuard; WireGuard vs OpenVPN compares them in detail.

Ports for IPsec VPN and IKEv2

IPsec is a suite, so the ports for an IPsec VPN come as a set. IKEv2 negotiates keys over UDP 500. When either side sits behind NAT, as most home routers and mobile networks do, the peers switch to UDP 4500 and wrap the encrypted ESP packets in UDP. Without NAT, ESP travels as IP protocol 50, with no port number at all.

IKEv2 is built into Windows, macOS, iOS and recent versions of Android, and its MOBIKE extension keeps a session alive when you switch between Wi-Fi and mobile data. Native support plus roaming is why it is common for corporate remote access.

L2TP/IPsec, PPTP and SSTP

L2TP uses UDP 1701 but has no encryption of its own, so it is paired with IPsec; a firewall then sees UDP 500, UDP 4500 and ESP, with 1701 carried inside the tunnel. PPTP uses TCP 1723 plus GRE, and its standard authentication is considered broken, so treat it as obsolete. SSTP, a Microsoft protocol, runs over TLS on TCP 443.

Firewall rules if you run your own server

• WireGuard: allow inbound UDP on your ListenPort (51820 if you kept the default).
• OpenVPN: allow inbound UDP 1194, or the port and transport set in the server config.
• IKEv2/IPsec: allow inbound UDP 500, UDP 4500 and IP protocol 50 (ESP).
• L2TP/IPsec: the IPsec rules above; accept UDP 1701 only when it arrives through the IPsec tunnel.

VLESS + Reality and port 443

VLESS is a lightweight proxy protocol that originated in V2Ray and is now mostly used with the Xray core. It does not encrypt traffic by itself and relies on the security layer underneath. Reality is one such layer, built on TLS 1.3 over TCP, and servers that use it typically listen on port 443, the same port every HTTPS website uses.

With Reality, the server does not need a TLS certificate for a domain of its own. Your client instead checks the server against a public key stored in your connection profile, and on the network the session looks like ordinary HTTPS traffic.

VLESS is not a packet-level VPN by design. Apps such as Happ and v2RayTun can create a virtual network interface (often called TUN mode) and relay your connections through the VLESS session, so it behaves like a VPN for everything routed through it. Flex-VPN offers VLESS + Reality as an alternative TCP/TLS profile; the subscription link already carries the address and port, and Happ refreshes the server list on its own. More in What Is VLESS?.

UDP vs TCP for VPN traffic

The transport often matters more than the port number. The apps inside a tunnel already handle reliability themselves: TCP resends lost packets, and so does QUIC, the UDP-based transport behind HTTP/3.

Why UDP is the default for tunnels

Over UDP, the tunnel simply forwards packets. If one is lost, the connection inside notices and resends it, exactly as it would without a VPN. That keeps latency low, which is why WireGuard, AmneziaWG and the default OpenVPN setup all use UDP.

The TCP-over-TCP problem

Run a packet-level VPN over TCP and two layers of reliability are stacked on top of each other. On a lossy link both layers retransmit and back off their timers at once, and throughput can collapse, an effect known as TCP meltdown. Proxy-style protocols such as VLESS avoid most of this: the client terminates your apps' connections locally and relays the data as a stream, so lost data is resent at one layer rather than two.

When TCP is the practical choice

Some connections handle UDP less reliably than TCP, for instance a router with very short UDP timeouts or a crowded hotspot that loses UDP packets under load. There, a TCP/TLS profile can give you a steadier session even though UDP is more efficient on paper.

On a work, school or hotel network, the owner sets the rules for what traffic is allowed, and some of these networks do not permit VPN connections. Ask the network administrator before using a VPN there. If a connection fails on a network you are free to use, try another network or another profile in your app.

How to find the port your VPN uses

The port is written into whatever you imported:

1. WireGuard or AmneziaWG config. Open the .conf file in a text editor and find the Endpoint line under [Peer]. The number after the last colon is the server port; the transport is always UDP.
2. OpenVPN profile. In the .ovpn file, the remote line lists the host and port, and the proto line shows udp or a tcp variant. If remote has no port, the port directive or the 1194 default applies.
3. vless:// link. The format is vless://ID@host:port?parameters#name. The number after the host is the port, and security=reality among the parameters marks a Reality profile.
4. Subscription link. This is an https:// address that returns a list of servers, so it has no single port. Import it and open a server's details in your app; many clients show the address, port and transport there.

Treat configs, keys and links like passwords: anyone who has them can use your connection, so don't paste them into public chats when you ask for help. If a connection keeps failing, Why Is My VPN Not Working? walks through the usual causes.

Which protocol fits which use

Which VPN protocol is best depends on the network and the job rather than on a single ranking:

What about the fastest VPN protocol?

For raw speed, WireGuard-based protocols usually have the edge thanks to their lean design and low per-packet overhead. Still, server distance, server load and your own connection often matter more than the protocol, so test on the network you actually use.

Flex-VPN supports two options, AmneziaWG and VLESS + Reality, so you can compare them yourself: start with AmneziaWG and try VLESS + Reality if a particular network is unreliable. Apps for each platform are on the download page, and AmneziaWG vs VLESS + Reality compares the two in depth.