0

So my organization is using VPN and Remote Desktop (RDP) for telecommuting. Due to some internal issues it has been requested of our Network staff to open ports 1433 and 1434 (SQL Server ports) to VPN traffic only so that local windows apps and SSMS can access SQL Server directly without RDP. So this is not opening up to public.

My question is, is this a big security risk to open those ports to the VPN traffic? It is being debated in our organization now. I don't think it would be a big risk because a hacker would need to gain VPN access and then get AD credentials or service account credentials to access the actual SQL Server. I believe those two layers of security make this low risk not high. Additionally, we recently updated all AD passwords to require more characters (15), special char, numeric, upper, lower.

3 Answers 3

0

There's always increased risks when opening up more potential attack vectors, generally speaking, ports in this case. But those are the two standard most ports for a SQL Server instance, that the risk is low, especially if you're limiting the inbound traffic to only VPN traffic.

If they weren't open to any traffic, then it wouldn't be possible to connect to your SQL Server instance at all, rendering it useless - though I assume you're saying you guys are opening them up to VPN traffic in addition to any internal traffic behind the same firewall as the server itself, and you probably are already aware of that.

In any case, allowing VPN traffic to those ports for a SQL Server instance is fairly standard, and is something I do personally as well.

1
  • 1
    Yes that is what I was saying and was aware the ports were open to internal traffic. :) Thanks for your response.
    – David
    Sep 29, 2021 at 23:30
0

Your question is a bit confusing: I'm not sure what you call "VPN traffic". Once a VPN connection is established, the target server sees "VPN traffic" as coming from the local network, unless you use VLANs to separate "true" local traffic from something that originates from VPN clients. In any case, that traffic is as secure as your users' workstations; if one of them is compromised, once it establishes a VPN connection it will have access to your internal network, including SQL Server instances. In other words, if you trust your users, there's no difference if they connect locally or via a VPN; if you don't, then you shouldn't let them connect to your databases in any case.

0

is this a big security risk to open those ports to the VPN traffic?

You're comparing Apples and Oranges (and Kumquats).

  • VPN is a way for machines on one network to be given access to machines on another network without opening the latter up to "The Public".
  • RDP is a protocol that allows you to connect from one computer to another and use the remote computer just like your local one - desktop, icons, folders, applications - all that good stuff.
  • SQLServer's internal protocol, on port 1433, only allows SSMS and other applications to "talk" to a SQLServer database.

The process is:

  • You connect to VPN. This brings your computer "into" the internal network.
  • You RDP onto another computer, logging in and using that computer "as" your own, running SSMS and other applications.

The important part is that having connected to the VPN, both machines - your own and the one you RDP into - should be able to connect to SQLServer in exactly the same way. They are both "in" the internal network and should be able to "see" all the same things.

1
  • There is a way to have a port open to internal traffic and have that same port closed to VPN only traffic and that is the case on our network. The Network Support team is insisting that if they open the ports for the VPN only that its a security risk. They are not saying they cant actually do it but that they don't want to.
    – David
    Sep 30, 2021 at 13:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.