Port 1433: SQL Server port and how to secure it

What port 1433 is

TCP port 1433 is the default port of a Microsoft SQL Server default instance. Clients such as SQL Server Management Studio, sqlcmd, ODBC drivers and application connection strings connect there using the TDS protocol. Azure SQL Database also accepts connections on 1433.

Named instances are different. They usually listen on a dynamic port chosen at startup, and clients find it by asking the SQL Server Browser service on UDP port 1434. That is why a connection string with server\INSTANCE works without a port number.

Port	Protocol	Used for
1433	TCP	Default instance
1434	UDP	SQL Server Browser (instance lookup)
Dynamic	TCP	Named instances, unless you set a fixed port

Should it be open to the internet?

No. A database port reachable from anywhere is scanned within minutes and receives constant password guessing, mostly against the sa login. Let only your application servers reach it, and use a VPN, a bastion host or an SSH tunnel for administration. If a cloud provider manages the server, restrict access with its firewall rules or private networking instead of allowing 0.0.0.0/0.

Firewall rules

On Windows, in PowerShell, allow one subnet only:

New-NetFirewallRule -DisplayName "SQL Server from app subnet" `
  -Direction Inbound -Protocol TCP -LocalPort 1433 `
  -RemoteAddress 192.0.2.0/24 -Action Allow

On a Linux host running SQL Server with ufw:

sudo ufw allow from 192.0.2.10 to any port 1433 proto tcp

To give a named instance a fixed port, open SQL Server Configuration Manager, go to the instance's TCP/IP protocol, clear "TCP Dynamic Ports" under IPAll, set "TCP Port", and restart the service. Then firewall that port like 1433.

How to check what is listening

On Windows:

netstat -ano | findstr :1433
Test-NetConnection db.example.com -Port 1433

On Linux:

sudo ss -tlnp | grep ':1433'
nc -zv db.example.com 1433

If the port is closed, check that the TCP/IP protocol is enabled in Configuration Manager; it is disabled by default in some editions such as Express and Developer.

Encryption

TDS traffic is not encrypted unless the client or server asks for it. Install a certificate on the server and set "Force Encryption", or use Encrypt=True in connection strings. Recent Microsoft drivers (for example Microsoft.Data.SqlClient 4.0 and later) default to Encrypt=True, which is why upgrades sometimes fail with a certificate trust error. Fix the certificate rather than switching on TrustServerCertificate in production.

Security notes

Disable or rename sa and use Windows authentication or Entra ID where you can.
Never expose UDP 1434 to the internet; it reveals your instances and has been used for amplification.
Changing the port to something else reduces log noise but is not a security control.
Keep SQL Server patched; old builds with known bugs are what automated scanners look for.

Port 3306: MySQL and MariaDB.
Port 5432: PostgreSQL.
Port 3389: Remote Desktop, often found on the same Windows hosts.

Check whether a host exposes 1433 or other database ports to the public internet with the Port Scanner.