VPN port numbers explained
- Author
- By Amelia Ame
- Last checked
- Updated September 10, 2026
- Reading time
- 5 min read
Each protocol has a default port, and one of them — TCP 443 — gets through firewalls that block everything else. Here is which is which and when to switch.
- Tested each provider against a network permitting only TCP 443
- Recorded which offer a port or protocol switch in the app rather than only in config files
- Verified the speed cost of moving from UDP to TCP on the same server
A firewall cannot block it without also blocking every website.
- WireGuard
- UDP 51820
- OpenVPN
- UDP 1194
- IKEv2
- UDP 500/4500
Defaults verified against each provider's own documentation
The short answer
WireGuard uses UDP 51820, OpenVPN uses UDP 1194 by default, and IKEv2 uses UDP 500 and 4500. The one worth remembering is TCP 443 — the port HTTPS uses — because a network cannot block it without blocking the web, which makes it the setting to switch to when a firewall stops your VPN connecting.
Ports are one of the few genuinely simple parts of networking, and VPN apps hide them well enough that most people never see one. You need this page for exactly one situation: a network that will not let your VPN connect.
The defaults
| Protocol | Port | Notes |
|---|---|---|
| WireGuard | UDP 51820 | The default; providers frequently use their own |
| OpenVPN UDP | UDP 1194 | The classic default, and widely recognised by firewalls |
| OpenVPN TCP | TCP 443 | The escape hatch — looks like HTTPS |
| IKEv2 / IPsec | UDP 500 and 4500 | Needs both; 4500 is for NAT traversal |
| L2TP / IPsec | UDP 500, 1701, 4500 | Old; three ports is part of why it is awkward |
| SSTP | TCP 443 | Microsoft's, also HTTPS-shaped |
| PPTP | TCP 1723 | Broken. Do not use it for anything private |
Two things to know about this table.
Commercial VPNs often ignore the defaults. Providers pick their own ports precisely because the published ones are the first thing a firewall blocks. That is why the port field in your app may show something unfamiliar.
UDP vs TCP is the more important choice than the number. UDP has less overhead and does not retransmit lost packets, which is right for a tunnel already carrying TCP inside it. TCP gets through more firewalls at a real cost in speed — TCP inside TCP causes retransmission pile-ups under packet loss, sometimes badly.
Why TCP 443 is the one to remember
Every HTTPS website uses TCP 443. Every single one.
A network that blocks TCP 443 breaks the entire web for its users, so essentially no network does. A VPN running over that port is therefore extremely hard to block by port alone — the traffic is arriving at the same port as all the ordinary browsing.
That makes it the answer to "my VPN will not connect here". Switch to OpenVPN TCP, or turn on your provider's stealth mode, and you are on 443.
The limit: port-based blocking is only the crude version. A network doing deep packet inspection examines the shape of the traffic rather than just its destination, and a plain OpenVPN connection over 443 still looks like OpenVPN. That is where obfuscation comes in — it makes the traffic itself resemble ordinary HTTPS, not just arrive at the same port.
| VPN | Stealth mode | Added ping | Avg speed | 2-year price |
|---|---|---|---|---|
 NordVPN | Yes | +4 ms | 712 Mbps | $3.39/mo |
 Surfshark | Yes | +6 ms | 655 Mbps | $2.19/mo |
 Proton VPN | Yes | +9 ms | 541 Mbps | $4.49/mo |
 ExpressVPN | Yes | +7 ms | 598 Mbps | $4.99/mo |
 Windscribe | Yes | +14 ms | 445 Mbps | $5.75/mo |
 Mullvad | Yes | +8 ms | 590 Mbps | $5.40/mo |
 CyberGhost | No | +12 ms | 470 Mbps | $2.19/mo |
Changing it
Most apps do not show you a port. They show a protocol dropdown, and changing that changes the port for you.
The order to try, when a network is blocking you:
- WireGuard (UDP) — the default, and what you want if it works
- OpenVPN UDP — some networks block WireGuard's ports specifically
- OpenVPN TCP — now on 443, gets through simple port filtering
- Stealth / obfuscated mode — 443 and disguised, beats packet inspection
Work down that list rather than starting at the bottom, because each step costs speed.
If your app exposes a custom port field, the useful values are 443 and 80. Port 80 is unencrypted HTTP's port — a VPN tunnel is still encrypted going over it, and some restrictive networks that scrutinise 443 leave 80 alone.
The other kind of port: forwarding
Worth separating, because the two get confused constantly.
The VPN port is what your device uses to reach the VPN server. That is everything above.
A forwarded port is one the VPN server opens on your behalf, so incoming connections can reach you through the tunnel. This is the torrenting one: without it, other peers cannot initiate a connection to you, so you can download but barely upload.
Only four of the ten VPNs we rate offer port forwarding — Proton VPN, Private Internet Access, PureVPN and Windscribe. The qBittorrent setup guide covers configuring it.
They are unrelated settings that happen to share a word.
When the port is not the problem
Before changing anything, rule these out:
Wrong credentials — a failed authentication and a blocked port produce similar-looking failures in some clients.
The VPN's servers being down — check the provider's status page.
A conflicting VPN client — two installed clients fighting over network adapters is a common cause of connections that fail for no visible reason.
Your own firewall or antivirus — some security software blocks VPN clients by default and does not announce it.
A captive portal — hotel and airport networks that require accepting terms will block everything, including your VPN, until you have. Turn the kill switch off briefly, accept the terms, then turn it back on.
The short version
Leave it on WireGuard and never think about ports. When a network refuses, switch to OpenVPN TCP or stealth mode — both land on 443, which nothing can block.
That is the entire practical content of this subject. The table above exists for the router configurations and the troubleshooting sessions where you need the actual number.
Common questions
What port does a VPN use?
It depends on the protocol. WireGuard defaults to UDP 51820, OpenVPN to UDP 1194, IKEv2 to UDP 500 and 4500, and SSTP to TCP 443. Most commercial VPNs let you change this in the app, and providers often use non-standard ports of their own rather than the published defaults.
Which VPN port is best?
UDP on the protocol's default port, for speed — that is what you want unless something is blocking it. TCP 443 is the fallback, because it is the port HTTPS uses and a network cannot block it without blocking every website. It is slower, so use it only when the fast option fails.
Why is TCP 443 special?
Because every HTTPS website in the world uses it. Any network that blocks TCP 443 breaks the entire web for its users, so essentially none do. A VPN running over that port is very hard to block by port alone — though deep packet inspection can still identify it as a VPN unless obfuscation is also on.
My VPN will not connect on this network. What port should I try?
Switch the protocol to OpenVPN TCP, or turn on your provider's stealth or obfuscated mode, both of which use TCP 443. If the app only exposes a protocol choice rather than a port number, that is the setting to change. If it still fails, the network is doing deep packet inspection and you need obfuscation specifically, not just the port.
Is UDP or TCP better for a VPN?
UDP, for everyday use. It has less overhead and does not retransmit lost packets, which suits a tunnel that is already carrying TCP inside it. TCP is the compatibility option — it gets through more firewalls and behaves better on very lossy connections, at a real cost in speed. Running TCP inside TCP causes retransmission pile-ups under packet loss.
Is the VPN port the same as a forwarded port for torrenting?
No, and they are easy to confuse. The VPN port is what your device uses to reach the VPN server. A forwarded port is one the VPN server opens on your behalf so incoming peers can reach you through the tunnel — that is the torrenting one, and only four of the ten providers we rate offer it.
Read next
- BasicsVPN protocols explainedUse WireGuard. That is the whole answer for almost everyone — and we measured the 3–5 ms it saves over OpenVPN. Here is when the other protocols still matter.
- PrivacyHow to unblock websitesFour different things block websites and each needs a different fix. Diagnosing which one you're facing takes thirty seconds and saves a wrong purchase.
- TorrentingHow to set up qBittorrent with a VPNBinding the client to the VPN adapter is stronger than a kill switch, and takes one dropdown. Then port forwarding, then the test that proves the whole thing holds.