IKE — the key negotiation in front of every IPsec VPN, and the port that identifies a VPN concentrator.
IKE runs over UDP 500 to authenticate the two peers and negotiate the keys and security associations that the IPsec ESP tunnel then uses; ISAKMP (RFC 2408) defined the original framework and IKEv2 (RFC 7296) is what current implementations speak. When a NAT sits in the path, peers detect it during the exchange and move to UDP 4500 with UDP encapsulation. IANA registers 500 for TCP as well, but the protocol is UDP in practice. An open 500 on a public address is a firewall, router, or VPN gateway doing exactly its job.
Fine to expose
Public by design for site-to-site and remote-access VPN. Two caveats: IKEv1 aggressive mode with a pre-shared key hands an offline-crackable hash to any prober, and the handshake can be abused for UDP reflection — use IKEv2 with certificates and rate-limit the port.
$ nmap -sU -p 500 --script ike-version TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.