Port 4500: IPsec NAT traversal
UDP port 4500 carries IPsec VPN traffic when one side is behind a router doing NAT.
What runs on port 4500
After IKE negotiates on UDP 500, IPsec switches to UDP 4500 whenever NAT is detected, wrapping encrypted packets in UDP so home routers can pass them. It is used by IKEv2 VPNs on iPhone, Mac and Windows, and by Wi-Fi Calling on many carriers.
On a home network
Routers running an IPsec or IKEv2 VPN server listen on 4500. Phones use it outbound for Wi-Fi Calling and VPNs, and Xbox consoles list it among their ports.
If port 4500 is reachable from the internet
Like 500, it is expected on a router that runs your VPN and is otherwise not something that should answer. The risk lies in the VPN software being out of date, not in the port.
How to check whether it is open on your network
Check your router's VPN server settings for IPsec or IKEv2. If Wi-Fi Calling fails at home, a router blocking outgoing UDP 4500 is worth ruling out.
To find out whether port 4500 is open on something in your home, and whether the internet can reach it, the app scans your Wi-Fi from your phone and checks your public address from the outside. It says what it checked and what it could not. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.