Port reference
Port 1433 (TCP) – Microsoft SQL Server
Default listener for Microsoft SQL Server database connections.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Listens on 1433 once the SQL Server TCP/IP protocol is enabled. Frequently bound to all interfaces and reachable from the LAN; sometimes exposed to the internet on misconfigured hosts.
What is port 1433 used for?
Port 1433 is the default network port for Microsoft SQL Server, Microsoft's relational database engine. Applications and admin tools such as SQL Server Management Studio (SSMS), Azure Data Studio, and database drivers in .NET, Java, Python, and PHP connect over 1433 to run queries and manage data. Named instances can use dynamic ports brokered by the SQL Server Browser on UDP 1434.
When would you open it?
Open or forward 1433 only if you run a SQL Server instance that other machines need to reach — for example an application server connecting to a separate database host. If your app and database live on the same machine, you don't need to open it at all; keep connections local.
Is it safe to open?
Exposing 1433 to the internet invites automated login attacks, so keep it on a
private network or VPN, require strong passwords and TLS, and never expose the
sa account. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1433
nmap -p 1433 <target>netstat -ano | findstr :1433
Test-NetConnection <host> -Port 1433lsof -i :1433
nmap -p 1433 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1433 to your device's local IP, internal port 1433, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1433/tcpsudo firewall-cmd --permanent --add-port=1433/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1433 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1433" -Direction Inbound -Protocol TCP -LocalPort 1433 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against the sa account
- Command execution via xp_cmdshell after login
- SQL injection pivoting to the database engine
- Lateral movement using captured SQL service credentials
Hardening
- Bind to localhost or a private interface; never expose 1433 to the internet
- Disable or rename the sa account and enforce strong, unique passwords
- Keep xp_cmdshell disabled and apply least-privilege roles
- Require TLS/encrypted connections and segment with host firewalls
- Patch promptly and monitor failed-login auditing
How to block this port
sudo ufw deny 1433/tcpsudo firewall-cmd --permanent --remove-port=1433/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1433 -j DROPNew-NetFirewallRule -DisplayName "Block 1433" -Direction Inbound -Protocol TCP -LocalPort 1433 -Action Blocknmap snippet
nmap -p1433 --script ms-sql-info,ms-sql-empty-password <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is it safe to expose port 1433 to the internet?
- No. Exposed SQL Server is mass-scanned and brute-forced. Keep 1433 on a private network behind a firewall or VPN, with strong auth and TLS.
- What is xp_cmdshell and why is it risky?
- It's a stored procedure that runs OS commands from inside SQL Server. If an attacker gets sysadmin access it becomes a direct path to host compromise, so it should stay disabled.