Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The Microsoft website states

The firewall must be configured to permit port 1433 incoming (or the port numbers that SQL Server listens to on TCP/IP), and ports 1024 to 65535 outgoing.

Does this mean that all firewall ports between 1024 and 65535 need to be opened for outbound traffic?

share|improve this question
    
Take a look at this StackOverflow question stackoverflow.com/questions/152834/default-port-for-sql-server –  Simon Sheehan Jun 22 '11 at 14:23
    
Tell me what you are trying to do: For example, connect through a firewall with the SQL Manager. –  KCotreau Jun 22 '11 at 14:23
    
we have an asp.net website that needs to pull data from a SQL Server database (default instance) using ado.net –  rob Jun 22 '11 at 14:25
    
The StackOverflow link doesn't answer the quesiton of outbound ports. I realise that I need to open port 1433 for the inbound request but opening 60k+ ports for outbound seems excessive. –  rob Jun 22 '11 at 14:28
    
Unless you are super paranoid most firewalls allow all outgoing connections by default (then block based off of rules). It is the inbound connections that get blocked by default (then allowed to pass by rules). It is VERY likely that ports 1024-65535 are already open outbound on your firewall. –  Scott Chamberlain Jun 22 '11 at 14:51
show 1 more comment

3 Answers

All the router-based firewalls I have used are configured to

  • Allow internally initiated TCP connections to any external port number.
  • Allow replies to any valid established connection.

The latter is part of "stateful packet inspection". The router/firewall tracks the state of active TCP connections.

So usually you don't have to explicitly permit replies to newly opened inbound ports.

For example, when I configure a router to allow inbound traffic to destination port 22 for SSH I don't have to also specify any additional rules concerning the replies (from source port 22 to any destination port#).

share|improve this answer
add comment

Inbound, you can start minimally, but I have found that just using those ports never seems to work. I always have to open these inbound:

TCP 1433, TCP 1434, TCP 1444, UDP 1434

As far as outbound, I am not 100% sure, but I would try this:

Go into the

SQL Server Configuration Manager (not the SQL Server Management Studio)>SQL Server Network Configuration>Protocols for MSSQLSERVER>TCP/IP>Properties>IP Addresses tab

and set the dynamic ports. Make sure you leave a range to allow for multiple connections, as it is probably one per port.

share|improve this answer
add comment

If I'm a program, and I"m connecting to another computer, I do need a port of my own. I create a socket, and the kernel now has to pick one. Usually the OS will allocate a port from a range called the Ephemeral Port Range. Now the client has the port, and can connect somewhere. To me, this looks like what the config is recommending you do - tell the firewall to allow the Ephemeral Port Range to go out to the Internet.

If you already have clients going out (Internet Explorer, Firefox, P2P clients, etc) then you already probably have this range open. There is nothing special SQL Server is asking for. Unlike the inbound port, this isn't a special 'SQL Server range' and if your other Internet apps can go out, it's already open. You'll probably find your firewall has a config letting these go out, or everything can go out. It may not be 1024-65535, since the recommendation here doesn't seem to match Windows' actual range.

I'd wonder much more why your SQL Server needs to connect outbound to the Internet. This seems odd to me unless you have a specific reason. You want as few things connecting to random places on the Internet as possible, at least not without you knowing why.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.