Windows Server Failover Clustering/SQL Server Firewall Access Rules
This document defines the firewall rules required for a Multi-Subnet Windows Server Failover Cluster (WSFC) environment. It covers WSFC core communication, the WSFC dependency on Active Directory (AD), and SQL Server Availability Group (AG) communication. Use these rules when you request network access for a Multi-Subnet Cluster.
This version corrects several rows to agree with current Microsoft documentation. See Verification Notes at the end of this document for the list of changes and sources.
Table of Contents
- Best Practice: IP Specificity
- Critical Action: Review Ephemeral Port Ranges
- Section 1: Core WSFC and Active Directory Ports
- Section 2: SQL Server Database Engine and Availability Group Ports
- Section 3: SQL Server BI Stack Ports (Conditional)
- Section 4: Multi-Subnet / Cloud Deployment Ports (Conditional)
- Section 5: Official References
- Verification Notes
- Windows Server 2025 / SQL Server 2025 Notes
Best Practice: IP Specificity
Specify exact IP addresses, or exact subnet masks, for all cluster endpoints. This includes every cluster node and every Availability Group Listener. Exact addressing makes sure that firewall rules apply correctly.
Critical Action: Review Ephemeral Port Ranges
Review the ephemeral port range. If company policy requires a different range for transient TCP/UDP traffic, change it. The default dynamic port range on current Windows Server versions is 49152 to 65535. Microsoft confirms this default in the RPC dynamic port documentation.
Section 1: Core WSFC and Active Directory Ports
These ports are required on all cluster nodes for basic cluster operation, network stability, and communication with Domain Controllers (DC).
| Port(s) | Protocol | Direction | Service / Function | Notes |
|---|---|---|---|---|
| 53 | TCP/UDP | Bi-Directional | DNS | This port supports all name resolution. |
| 88 | TCP/UDP | Bi-Directional | Kerberos Authentication | UDP carries standard ticket requests. TCP carries tickets that are too large for UDP. |
| 123 | UDP | Outbound | NTP (Windows Time) | This port keeps node time synchronized with the Domain Controller. |
| 135 | TCP | Bi-Directional | RPC Endpoint Mapper | The Cluster Service uses this port. This port also finds the dynamic RPC port for WSFC and MS DTC traffic. This port has no UDP type. |
| 137 | UDP | Bi-Directional | NetBIOS Name Resolution (NBNS) | This port is legacy. DNS (53) replaces it. We recommend that you block this port. |
| 138 | UDP | Bi-Directional | NetBIOS Datagram Service (NBD) | This port is legacy. SMB (445) replaces it. We recommend that you block this port. |
| 139 | TCP | Bi-Directional | NetBIOS Session Service (NBSS) | This port is legacy. SMB (445) replaces it. We recommend that you block this port. |
| 389 | TCP/UDP | Bi-Directional | LDAP | This port carries unencrypted queries and writes to Active Directory. |
| 445 | TCP | Bi-Directional | SMB/CIFS | This port grants access to shared resources. Examples are the Cluster Shared Volume (CSV) and the File Share Witness (FSW). This port uses TCP only. SMB has no UDP mode on current Windows versions. |
| 464 | TCP/UDP | Bi-Directional | Kerberos Password Change | This port supports secure password changes and trust maintenance. |
| 636 | TCP | Bi-Directional | LDAPS (LDAP over TLS) | This port carries encrypted queries and updates to Active Directory. This port has no UDP type. |
| 3268 | TCP | Bi-Directional | Global Catalog (GC) LDAP | This port carries unencrypted, forest-wide user and group lookups. |
| 3269 | TCP | Bi-Directional | Global Catalog (GC) LDAPS | This port carries encrypted, forest-wide user and group lookups. We recommend port 3269 over port 3268. |
| 3343 | UDP | Bi-Directional | Cluster Network Driver (NetFT) heartbeat | This port is the primary heartbeat channel. It uses DTLS 1.0 or 1.2 for security. |
| 3343 | TCP | Bi-Directional | Cluster Network Driver (NetFT), node join only | This port is required only during a node join operation. It is not part of the ongoing heartbeat. |
| 49152–65535 | TCP/UDP | Bi-Directional | RPC Dynamic Ports | This port range carries the WSFC heartbeat and state data. It also carries MS DTC traffic. Port 135 sets up this traffic. |
| N/A | ICMPv4 | Bi-Directional | Ping | This protocol supports basic reachability testing. Only administrators use it, for diagnostics. The Add Node Wizard requires it during a node join operation. |
Section 2: SQL Server Database Engine and Availability Group Ports
These ports are required for client connectivity, AG replication, and remote administration.
| Port(s) | Protocol | Direction | Service / Function | Notes |
|---|---|---|---|---|
| 1433 | TCP | Inbound | SQL Database Engine | This port is the default entry point for client applications and the AG Listener. |
| 1434 | UDP | Inbound | SQL Server Browser | This port tells clients the dynamic port number of a named instance. |
| 3389 | TCP | Inbound | RDP | This port gives administrative console access to the Windows Server node. |
| 3389 | UDP | Inbound | RDP (enhanced session transport) | The current RDP transport uses this port together with the TCP channel. Microsoft documents both TCP and UDP for RDS. |
| 5022 | TCP | Bi-Directional | AG Replication Endpoint | The primary replica sends transaction log blocks to secondary replicas over this port. An administrator chooses this port. Microsoft does not fix a default port. Microsoft's own examples use port 5022 or port 7022. Run this query to confirm the actual port: SELECT name, protocol_desc, port, state_desc FROM sys.tcp_endpoints WHERE type_desc = 'DATABASE_MIRRORING' |
| 5985 | TCP | Inbound | WinRM (HTTP) | This port supports PowerShell Remoting over unencrypted HTTP. This port has no UDP type. |
| 5986 | TCP | Inbound | WinRM (HTTPS) | This port supports PowerShell Remoting over encrypted HTTPS. This port has no UDP type. |
| 161 | UDP | Inbound | SNMP Agent | This port lets monitoring systems poll node health. |
| 162 | UDP | Outbound | SNMP Traps | This port sends critical event alerts to monitoring systems. |
Load balancer health probe ports (cloud or multi-subnet deployments only) are in Section 4.
Section 3: SQL Server BI Stack Ports (Conditional)
If SSAS, SSRS, or SSIS runs on the cluster nodes, these ports become necessary.
| Port(s) | Protocol | Direction | Service / Function | Notes |
|---|---|---|---|---|
| 2382 | TCP | Inbound | SSAS Redirector (SQL Server Browser) | The SQL Server Browser service listens on TCP port 2382. It redirects the client to the port that the named Analysis Services instance uses. Microsoft states this plainly: UDP is not used. TCP is the only protocol that SQL Server Analysis Services uses. |
| 2383 | TCP | Inbound | SSAS Default Instance | This port is the direct connection port for the default Analysis Services instance. |
| Varies | TCP | Inbound | SQL Server Reporting Services (SSRS) | The default is TCP 80/443 (HTTP/HTTPS). Many deployments use a custom, high port number. Check SSRS Configuration Manager for the actual value. |
| 135 | TCP | Inbound | SQL Server Integration Services (SSIS) | The Integration Services service uses DCOM on TCP port 135 to start, stop, and control the service remotely. You cannot change the port number. SSIS does not use UDP. If you connect to a remote Integration Services instance from Management Studio or a custom application, you need this port. |
Section 4: Multi-Subnet / Cloud Deployment Ports (Conditional)
Two cases need these ports. Case one: the Availability Group spans multiple subnets. Case two: the Availability Group runs in a public cloud (Azure/AWS) environment. Both cases need an Internal Load Balancer (ILB) for the AG Listener (AGL) IP.
The ILB routes client traffic to the active replica. It uses TCP health probes to do this. Allow these probe ports inbound from the ILB subnet to the cluster nodes.
| Port(s) | Protocol | Direction | Service / Function | Notes |
|---|---|---|---|---|
| 58888 | TCP | Inbound | Cluster Core Probe (example port) | This port carries the load balancer health probe for the Cluster Name Object (CNO). An administrator chooses this port number. |
| 59999 | TCP | Inbound | AG Listener Probe (example port) | This port carries the load balancer health probe for the AG Listener (AGL). An administrator chooses this port number. |
Section 5: Official References
Windows Server Failover Clustering (WSFC) ports Microsoft Learn: Service overview and network port requirements. This page covers core AD ports (53, 88, 135, 389, 445). It also covers NetBIOS (137, 138, 139), the Cluster Service (3343), and the RPC dynamic port range (49152–65535).
SMB/CIFS protocol confirmation Microsoft Learn: Direct hosting of SMB over TCP/IP. This page confirms SMB direct hosting uses TCP port 445 only. There is no UDP mode.
SQL Server Core and Availability Group (AG) ports Microsoft Learn: Configure the Windows Firewall to Allow SQL Server Access. This page covers the Database Engine (1433), SQL Server Browser (1434 UDP), the Database Mirroring/AG endpoint (5022 example), and Integration Services (135 TCP only, DCOM).
SQL Server Analysis Services (SSAS) ports Microsoft Learn: Configure the Windows Firewall to Allow Analysis Services Access. This page confirms both 2382 (SQL Server Browser) and 2383 (default instance) use TCP only.
Multi-Subnet / cloud deployment (load balancer probes) Microsoft Learn: Configure Availability Group Listeners and Load Balancer (PowerShell). This page explains load balancer health probes for the AGL IP address. An administrator chooses the probe port numbers. Microsoft does not fix these numbers.
Verification Notes
This table lists the rows that changed, after a comparison with current Microsoft documentation.
| Port(s) | Original claim | Corrected to | Reason |
|---|---|---|---|
| 137, 138, 139 | Grouped as one row: "137-139, UDP/TCP" | Split into three rows: 137/UDP, 138/UDP, 139/TCP | Microsoft documents distinct, single protocols per port. There is no 137/TCP, 138/TCP, or 139/UDP. |
| 445 | TCP/UDP | TCP only | Microsoft's SMB direct-hosting documentation and every reference in the general Windows Server port list show SMB as TCP 445 only. No UDP mode exists. |
| 3343 | Single row, "TCP/UDP... must allow both for compatibility" | Split into two rows: UDP (primary heartbeat, DTLS-secured) and TCP (node join only) | Microsoft documents ongoing Cluster Service heartbeat traffic as UDP with DTLS. Microsoft calls out TCP port 3343 separately. Windows needs it only during a node join operation. |
| 2382 | UDP | TCP | Microsoft states directly: "SQL Server Browser service listens on TCP port 2382. UDP is not used." The original document likely confused this with the unrelated SQL Server Browser UDP 1434 rule for the Database Engine. |
| SSIS row | TCP/UDP, Bi-Directional | TCP, Inbound, port 135 only | Microsoft's SQL Server firewall documentation states Integration Services uses DCOM on TCP port 135, with no UDP component. |
| 3389 | TCP only | TCP and UDP | Microsoft's general Windows Server port list documents RDS (Remote Desktop Services) on both TCP 3389 and UDP 3389. |
| 5022 | Presented as a fixed default | Presented as an administrator-chosen port (with a query to confirm the actual value) | Microsoft states there is no default port for database mirroring/AG endpoints. Its own examples use port 5022 or port 7022. |
Windows Server 2025 / SQL Server 2025 Notes
This document targets Windows Server 2022 and SQL Server 2022. This section notes what changes for firewall planning if a project moves to Windows Server 2025 and SQL Server 2025. No port numbers change. Two items affect the ports and encryption you need.
| Item | What changes in the 2025 versions | Effect on this document |
|---|---|---|
| TDS 8.0 with enforced TLS 1.3 | SQL Server 2025 can require strict TLS 1.3 encryption on connections to the Database Engine (1433) and the AG endpoint (5022). | This adds no new port. Traffic on these ports is now optionally TLS 1.3-only. Before you turn this on, confirm client and driver support. |
| Domain-independent Availability Groups (Windows Server 2025 workgroup clusters) | An AG can run in a workgroup cluster, with no Active Directory domain. | See the note below this table. |
If you use domain-independent Availability Groups, drop these Active Directory-dependent ports from Section 1:
- Port 53 (DNS)
- Port 88 (Kerberos)
- Port 389 (LDAP)
- Port 636 (LDAPS)
- Ports 3268-3269 (Global Catalog)
- Port 464 (Kerberos Password Change)
The core WSFC ports still apply: 135, 137-139, 445, 3343, 49152-65535, and ICMP. The AG-specific ports in Section 2 also still apply. SQL Server FCI still needs a domain. This exception applies only to AG-only, workgroup-cluster deployments.
No luck with these. After opening the ports for windows cluster the cluster validation tool fails on firewall rules.
ReplyDeletesame problem here sandiagan. Any resolution since?
DeleteI think all it requires is ICMP other than that above ports are sufficient. You might want to have a look at this article: http://cybergav.in/2013/07/28/windows-server-failover-cluster-port-requirements-for-intra-node-connectivity/
DeleteThis comment has been removed by the author.
ReplyDelete