By convention WireGuard uses UDP 51820 as its ListenPort – the port is not IANA-registered, but almost every guide uses it. TCP is not supported.
Open it inbound on a VPN server. WireGuard only responds to packets with a valid key, so a port scan shows nothing – the port is practically invisible. Through the tunnel you reach SSH, RDP, databases or NFS internally without exposing them.
Typical: no latest handshake in wg show (firewall, wrong endpoint or public key), tunnel drops behind NAT (PersistentKeepalive = 25), or large packets stall (MTU, e.g. MTU = 1380).
Check
sudo wg show