NetSecWallFree trialDownload
Ports 500 and 4500 · UDP

Ports 500 and 4500: IKE / IPsec (VPN)

Internet Key Exchange, which sets up IPsec VPNs such as IKEv2 and L2TP/IPsec. 4500 carries IPsec through home routers (NAT traversal).

Protocol
UDP
On Windows
svchost.exe (IKE and AuthIP IPsec Keying Modules, IKEEXT)
Risk if open to the internet
Medium

Seeing it on your PC

Normal while a built-in Windows VPN or a corporate VPN client is connecting.

Should you block it?

Allow it outgoing if you use one of these VPNs. A home PC has no reason to accept incoming 500 or 4500.

Check it on your PC

Run this in PowerShell to see what is using port 500 right now, and which program owns it:

Get-NetUDPEndpoint -LocalPort 500 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.

Block it in Windows Firewall

In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.

New-NetFirewallRule -DisplayName "Block inbound UDP 500,4500" -Direction Inbound -Protocol UDP -LocalPort 500,4500 -Action Block

Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.