VPNSmith
Free tool - WireGuard port

WireGuard port checker

Online port scanners cannot test WireGuard: it answers nothing to a stranger, so every scan says "open|filtered". This checker answers the real questions instead: can your router forward a port at all, which firewall line opens it, and which command proves a client gets through.

Behind CGNAT? A VPS with its own public IPv4 needs no port forward: see the Contabo offer

Runs in your browser. Your public IP is fetched from the free ipify API only when you click the button; nothing is sent to us or stored.

Default 51820. UDP only: WireGuard has no TCP mode.

Where does the server run?

Look for "WAN IP", "Internet IP" or "IPv4 address" on the internet status page of your router or ISP box.

Your public IP as the internet sees it

The local address of the machine running WireGuard, ideally a DHCP reservation.

A DNS name or IP for the client Endpoint line. Empty = the detected IP, or a placeholder.

Server firewall

Can a port forward reach this server?

Enter your router's WAN address and detect your public IP: the comparison tells whether a port forward can work at all. Until then, the rules below assume it can.

Router port forward rule

ProtocolExternal portInternal IPInternal port
UDP51820192.168.1.1051820
Open the port in the server firewall
sudo ufw allow 51820/udp comment 'WireGuard'
sudo ufw status numbered
Matching ListenPort and Endpoint lines
# Server: /etc/wireguard/wg0.conf
[Interface]
ListenPort = 51820

# Every client: [Peer] section pointing at the server
[Peer]
Endpoint = <server public IP or DNS name>:51820
The only test that proves the port is open
# 1. Is WireGuard listening on the port you think?
sudo wg show wg0 listen-port
sudo ss -ulnp | grep ':51820 '
# 2. Watch the port while a client connects from OUTSIDE (phone on mobile data, Wi-Fi off)
sudo tcpdump -ni any udp port 51820
#    Packets arrive  -> router and firewall are fine; check keys and AllowedIPs.
#    Nothing arrives -> blocked before the server: port forward, ISP box, CGNAT or cloud firewall.
# 3. Final proof
sudo wg show wg0 latest-handshakes

Why not an online port check? WireGuard is silent by design: it does not answer packets that are not a valid handshake from a known key. A UDP scanner therefore reports "open|filtered" for an open port and for a blocked one alike. Only tcpdump on the server, or a handshake from outside, tells the difference.

Rather skip router rules altogether?

On a VPS with a public IPv4 the port you open is the port the internet sees: one firewall line, no router, no ISP box. Contabo's entry VPS comes with a public IPv4 and full root access.

Affiliate link: we may earn a commission at no extra cost to you. The checker stays free either way.

See the Contabo VPS

What your router's WAN address tells you

Open your router's status page and read the IPv4 address of its internet (WAN) side. That single number decides whether a port forward can work.

WAN addressMeaningPort forward
100.64.0.0 to 100.127.255.255Carrier-grade NAT (RFC 6598): the ISP shares one public IP between customersImpossible on your side
10.x, 172.16-31.x, 192.168.xPrivate (RFC 1918): another router or the ISP box sits in frontNeeded on both devices
169.254.x.xLink-local: the WAN has no real addressFix the connection first
Public, same as your detected IPYour router holds the public addressWorks
Public, different from your detected IPAnother NAT, or you are testing through a VPN or proxyCheck before forwarding
Full guide: WireGuard ports, changing ListenPort, UDP 443 and forwarding →Behind CGNAT: every workaround compared (IPv6, public IP from the ISP, VPS relay) →

Frequently asked questions

How do I check if my WireGuard port is open?
Not with an online port scanner. WireGuard drops any packet that is not a valid handshake from a known peer, without answering, so a UDP scan shows "open|filtered" whether the tunnel listens or not. The reliable test has three steps: confirm the server listens (wg show wg0 listen-port, ss -ulnp), run tcpdump -ni any udp port 51820 on the server, then connect a client from outside your network (a phone on mobile data with Wi-Fi off). Packets in tcpdump mean the port is reachable; a recent handshake in wg show means the tunnel works.
What port does WireGuard use?
UDP 51820 by default, set by ListenPort in the [Interface] section of wg0.conf. WireGuard never uses TCP. You can choose any free UDP port from 1 to 65535, as long as the server firewall, the router forward and the Endpoint line of every client use the same number.
How do I know if I am behind CGNAT?
Compare the WAN address shown by your router with your public IP as seen from the internet. If the WAN address starts with 100.64 to 100.127, your ISP uses carrier-grade NAT. If the WAN address is public but different from your public IP, there is another NAT layer in front of you. In both cases a port forward on your router never receives traffic from the internet. The checker above does the comparison for you.
Can I run a WireGuard server behind CGNAT?
Not as a directly reachable server. The usual ways out are: ask the ISP for a public IPv4 (some do it for free or for a fee), use IPv6 if your ISP gives a routed prefix and your clients have IPv6 too, or put a small VPS with a public IPv4 in front and let your home connect out to it. The VPS route works on every network because both sides only make outgoing connections.
Does a VPS need port forwarding for WireGuard?
No. A VPS usually has its public IPv4 directly on its network interface, so there is no router to forward through. You only need to allow the UDP port in the server firewall and, if your provider has one, in its cloud firewall or security group.