Port 1433: Microsoft SQL Server

What uses port 1433

A default SQL Server instance listens on TCP 1433. Named instances use dynamic ports and are found through the SQL Server Browser service on UDP 1434. Azure SQL Database also uses 1433. SQL Server is a frequent target of password-guessing attacks, especially against the sa account.

Should port 1433 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Can’t connect remotely? Enable TCP/IP in SQL Server Configuration Manager, restart the service, and allow 1433 in Windows Firewall.
• Disable the sa login or give it a long random password, and use Windows or Entra ID authentication where possible.

Check what is listening on port 1433

sudo ss -ltnp 'sport = :1433'

sudo lsof -nP -iTCP:1433 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 1433 -State Listen
netstat -ano | findstr :1433

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 1433

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:1433 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 1433 -State Listen).OwningProcess

Allow port 1433 from trusted networks only

The examples allow 1433 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 1433 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 1433 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="1433" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Microsoft SQL Server 1433/TCP" -Direction Inbound -Protocol TCP -LocalPort 1433 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 1433 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 1433:1433 would expose the port to the whole network.
docker run -d -p 127.0.0.1:1433:1433 mcr.microsoft.com/mssql/server

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 1433 from another machine

nc -zv example.com 1433

Test-NetConnection example.com -Port 1433

Related ports

• Port 1434 (SQL Server Browser): used by the SQL Server Browser service to locate named instances.
• Port 3306 (MySQL / MariaDB): the default port for MySQL and MariaDB.
• Port 5432 (PostgreSQL): the default port for PostgreSQL.
• Port 1521 (Oracle Database): the default port for the Oracle Database listener.

More databases ports

6379 (Redis) , 8086 (InfluxDB) , 9042 (Cassandra / ScyllaDB) , 9200 (Elasticsearch / OpenSearch) , 9300 (Elasticsearch transport) , 11211 (Memcached) , 27017 (MongoDB) . See all ports in the port lookup.

Sources

• IANA port registry: 1433

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions