Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have a web server trying to communicate to a SQL Server through a firewall, and the firewall is completely closed both ways (inbound AND outbound), I know I have to open port 1433 from the web server to the SQL Server in that direction.

However, do I need to open any ports from the SQL Server to the web server for the SQL activities to work? Does SQL Server respond back with any other ports?

share|improve this question

I would suggest following the guildelines provided by Microsoft here: TCP/IP port numbers required to communicate to SQL overall a firewall

By default, when an application requests a socket from the system for an outbound call, a port number between the values of 1024 and 5000 is supplied.

You brought up the above statement in your comments to the other answers. This is something you have to handle on your firewall. The client chooses the port it wants to be communicated back on. As stated later down in the article above your firewall rules have to allow the dynamic allocation to occur.

I don't work with the application side but there might be something you do to force the port it wants to talk on.

share|improve this answer

No. You only need to open the port inbound to the database server from the web server. Your database server does not need outbound connections to your web server.

The only common protocol that involves opening connections in both directions (and thus requires firewall ports in both directions) is FTP (which you really shouldn't be using, use SFTP!).

share|improve this answer
But what about this, that says the sql server will try to make connections outbound on ports 1024 --> 5000 – M.R. Oct 17 '13 at 21:39

Sql server default instance use tcp port 1433 by default for incoming connections, but you can choose another one. If this is the case, no need to configure your client. Only your server to accept incoming traffic on tcp port 1433. If its a named instance, you can either specifie a tcp port or choose a dynamic one. In that case, sql server browser service need to be started and you are looking for UDP port 1434 to be open on both, server and client.

share|improve this answer
But what about this, that says the sql server will try to make connections outbound on ports 1024 --> 5000 – M.R. Oct 17 '13 at 21:40
That's the source port for the client TCP statck to connect to the server. It's randomly chosen by the client's operating systems TCP stack (which on windows defaults to choosing something between 1024 and 5000). You do not need to open firewall traffic from for that port from the server to your client because it'll happen automatically as your client is the one initiating the connection. Your firewall will see that it's the continuation of network traffic your client itself initiated and it will be allowed. – sehrope Oct 17 '13 at 22:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.