Port 51820: WireGuard
Port 51820 is the default port for WireGuard, a modern, fast VPN.
What runs on port 51820
WireGuard listens on UDP 51820 by default, though any port can be used. It is built into the Linux kernel, is small enough to audit, and uses modern cryptography with key-based authentication only. Tailscale and many commercial VPNs are built on it.
On a home network
Routers with WireGuard support (OpenWrt, GL.iNet, recent ASUS and UniFi models), NAS boxes, Raspberry Pis running PiVPN or wg-easy, and Home Assistant with the WireGuard add-on can listen on 51820.
If port 51820 is reachable from the internet
Exposing WireGuard is its purpose, and it is one of the safer things you can put on the internet. It stays silent to any packet that is not signed with a valid key, so scanners cannot even tell it is there. Protect the private keys and remove peers you no longer use.
How to check whether it is open on your network
Your router's or server's WireGuard settings show the listening port and peers. Because WireGuard does not reply to unknown packets, a port scan will usually report 51820 as closed or filtered even when it is working.
To find out whether port 51820 is open on something in your home, and whether the internet can reach it, the app scans your Wi-Fi from your phone and checks your public address from the outside. It says what it checked and what it could not. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.