SQL Server Ports

Question

The Microsoft website states

The firewall must be configured to permit port 1433 incoming (or the port numbers that SQL Server listens to on TCP/IP), and ports 1024 to 65535 outgoing.

Does this mean that all firewall ports between 1024 and 65535 need to be opened for outbound traffic?

Answer 1

All the router-based firewalls I have used are configured to

• Allow internally initiated TCP connections to any external port number.
• Allow replies to any valid established connection.

The latter is part of "stateful packet inspection". The router/firewall tracks the state of active TCP connections.

So usually you don't have to explicitly permit replies to newly opened inbound ports.

For example, when I configure a router to allow inbound traffic to destination port 22 for SSH I don't have to also specify any additional rules concerning the replies (from source port 22 to any destination port#).

Answer 2

Inbound, you can start minimally, but I have found that just using those ports never seems to work. I always have to open these inbound:

TCP 1433, TCP 1434, TCP 1444, UDP 1434

As far as outbound, I am not 100% sure, but I would try this:

Go into the

SQL Server Configuration Manager (not the SQL Server Management Studio)>SQL Server Network Configuration>Protocols for MSSQLSERVER>TCP/IP>Properties>IP Addresses tab

and set the dynamic ports. Make sure you leave a range to allow for multiple connections, as it is probably one per port.

Answer 3

If I'm a program, and I"m connecting to another computer, I do need a port of my own. I create a socket, and the kernel now has to pick one. Usually the OS will allocate a port from a range called the Ephemeral Port Range. Now the client has the port, and can connect somewhere. To me, this looks like what the config is recommending you do - tell the firewall to allow the Ephemeral Port Range to go out to the Internet.

If you already have clients going out (Internet Explorer, Firefox, P2P clients, etc) then you already probably have this range open. There is nothing special SQL Server is asking for. Unlike the inbound port, this isn't a special 'SQL Server range' and if your other Internet apps can go out, it's already open. You'll probably find your firewall has a config letting these go out, or everything can go out. It may not be 1024-65535, since the recommendation here doesn't seem to match Windows' actual range.

I'd wonder much more why your SQL Server needs to connect outbound to the Internet. This seems odd to me unless you have a specific reason. You want as few things connecting to random places on the Internet as possible, at least not without you knowing why.