Брандмауэр «Windows Firewall». Настройка и отключение.

Правильная настройка встроенных средств защиты Windows 10 позволяет комфортно и безопасно использовать компьютер. Ниже будут приведены основные способы настройки и варианты с полным отключением защиты.

Содержание:

Windows Firewall – важный компонент комплекса встроенной защиты операционной системы предназначенный для блокировки и ограничения входящего и исходящего трафика. С его помощью можно выборочно заблокировать подключение к сети для определенных приложений, что значительно повышает безопасность и защиту от вредоносного ПО, которое может отправлять данные и личную информацию сторонним лицам.

Такая информация может быть использована в корыстных целях, например, для воровства аккаунтов социальных сетей и различных сервисов, электронных почтовых ящиков или взлома электронных кошельков пользователя. После установки чистой операционной системы Windows, брандмауэр будет активирован по умолчанию. Сообщения о блокировке доступа в сеть приложениям демонстрируются при запуске неизвестного ПО. На экране оповещения системы безопасности можно выбрать режим предоставления доступа приложения к сети: доступ только к частным сетям или полный доступ ко всем сетям.

При выборе первого варианта запущенное приложение будет иметь доступ только к частным сетям пользователя без выхода в интернет. Второй вариант дает программе полный доступ в открытую сеть.

Зачем отключать Windows Firewall?

Окно «Оповещение системы безопасности» является единственным, что может помешать пользователю при включенном защитнике, поэтому брандмауэр Windows работает очень ненавязчиво и многие предпочитают оставлять его включенным. Такой подход – наиболее оптимален, поскольку даже встроенной системы защиты – вполне достаточно для обычных пользователей.

Стоит добавить, многие разработчики вирусного ПО утверждают, что стандартная система безопасности Windows 10 имеет незначительное количество уязвимостей, которые заполняются при постоянных обновлениях ОС. Конечно это не гарантирует стопроцентную защиту от узкоспециализированного хакерского ПО, но обеспечивает высокую степень безопасности при попадании рядовых вирусов.

В некоторых случаях пользователь предпочитает устанавливать защиту своей системы от сторонних производителей. В таких случаях брандмауэр Windows можно отключить при установке нового антивирусного комплекса. Это поможет избежать конфликта между различными системами безопасности.

Настройки Windows Firewall

Для настройки параметров защитника Windows следует перейти в расширенные настройки брандмауэра. Для этого:

Шаг 1. Нажимаем по иконке поиска возле по «Пуск» и вводим фразу «Панель управления».

Шаг 2. В открывшемся окне, выбираем режим отображения «Мелкие значки» и переходим в «Брандмауэр защитника Windows».

Шаг 3. Чтобы перейти в окно расширенных настроек защиты, выбираем пункт «Дополнительные параметры».

Находясь в меню «Дополнительные параметры» можно посмотреть текущее состояние защитника и его основные настройки. Данная информация находится в первом пункте «Монитор брандмауэра».

Для создания собственных блокировок определенных приложений, следует воспользоваться графой «Правила для исходящих подключений», где следует выбрать пункт «Создать правило».

В открывшемся окне присутствует несколько вариантов блокировок сети. К примеру, можно заблокировать целый порт или конкретную программу. В нашем случае будет заблокирована конкретная программа, поэтому выбираем первый пункт и нажимаем далее.

Для блокировки конкретной программы, следует выбрать пункт «Путь программы» и выбрать необходимое приложение. Для примера, блокировка будет произведена на браузере Google Chrome. Исполняемый файл браузера находится по пути «C:\Program Files (x86)\Google\Chrome\Application». Его можно выбрать в пункте обзор, или самостоятельно ввести, скопировав путь из проводника.

Выбрав необходимую программу, следует выбрать действие, которое будет применено. Для блокировки, выбираем пункт «Блокировать подключение» и далее.

В следующем окне следует выбрать те профили, к каким будет применено созданное правило блокировки.

В последнем окне необходимо задать имя правилу. Для удобства поиска данной настройки называем её «Блокировка подключения Google Chrome» и подтверждаем действие кнопкой «Готово».

После выполнения вышеуказанных действий браузер Google Chrome перестанет подключаться к сети Интернет. Перезагрузка компьютера не потребуется.

Чтобы вернуть работоспособность браузера необходимо найти созданное правило в списке, нажать по нему ПКМ и выбрать пункт «Отключить». Если в настройке более нет необходимости, её можно удалить.

Стоит понимать, что не все исполнительные файлы относятся к подключению, поэтому в некоторых случаях блокировка может оказаться неэффективной. Чтобы устранить это, следует узнать через что происходит подключение к интернету и уже блокировать данный элемент. К примеру, многие онлайн игры, работающие на Jawa, подключаются к сети через исполнительный файл Jawa, а не собственный. Таким образом для блокировки игры необходимо заблокировать доступ исполнительного файла Jawa.

Как полностью отключить брандмауэр Windows?

Существует несколько быстрых способов полного отключения Windows Firewall, которые следует применять перед установкой новой защитной системы от сторонних производителей. Отключение защитника делает систему уязвимой для вредоносного ПО, поэтому отключать брандмауэр без нужды – строго не рекомендуется.

Отключение брандмауэра в панели управления

Одним из самых легких способов отключения защиты, является отключение через панель управления. Чтобы сделать это, необходимо:

Находясь в панели управления в пункте «Брандмауэр защитника Windows» следует перейти в пункт «Включение и выключение защитника».

В открывшемся окне достаточно перевести все пункты в отключенный режим и подтвердить действие кнопкой «Ок».

Отключение защитника при помощи командной строки

Другим способом отключения защитника Windows является командная строка. Чтобы выполнить отключение, необходимо:

Нажать ПКМ по кнопке пуск и выбрать «Командная строка(администратор)», «Windows PowerShell (администратор)».

В открывшемся окне командной строки вводим «netsh advfirewall set allprofiles state off» и подтверждаем Enter.

Данная команда отключит все профили сети и Windows Firewall станет неактивным.

Для включения защитника следует воспользоваться командой «netsh advfirewall set allprofiles state on».

Часто задаваемые вопросы

Это сильно зависит от емкости вашего жесткого диска и производительности вашего компьютера. В основном, большинство операций восстановления жесткого диска можно выполнить примерно за 3-12 часов для жесткого диска объемом 1 ТБ в обычных условиях.

Если файл не открывается, это означает, что файл был поврежден или испорчен до восстановления.

Используйте функцию «Предварительного просмотра» для оценки качества восстанавливаемого файла.

Когда вы пытаетесь получить доступ к диску, то получаете сообщение диск «X: \ не доступен». или «Вам нужно отформатировать раздел на диске X:», структура каталога вашего диска может быть повреждена. В большинстве случаев данные, вероятно, все еще остаются доступными. Просто запустите программу для восстановления данных и отсканируйте нужный раздел, чтобы вернуть их.

Пожалуйста, используйте бесплатные версии программ, с которыми вы можете проанализировать носитель и просмотреть файлы, доступные для восстановления.

Сохранить их можно после регистрации программы – повторное сканирование для этого не потребуется.

Firewall & network protection in Windows Security

Firewall & network protection in Windows Security lets you view the status of Microsoft Defender Firewall and see what networks your device is connected to. You can turn Microsoft Defender Firewall on or off and access advanced Microsoft Defender Firewall options for the following network types:

Domain (workplace) networks

Private (discoverable) networks

Public (non-discoverable) networks

If you want to change a setting select the network type you want to change it on.

You can specify that a particular network your device connects to is «private» or «public». The key difference is whether other devices on the same network are allowed to see, and maybe connect to, your device.

Your home network might be an example of a private network — in theory the only devices on that network are your devices, and devices owned by your family. So you might be fine with those other devices being able to see yours. We call that «discoverable» because all the devices on that network are allowed to «discover» each other.

The Wi-Fi at your local coffee shop, however, is a public network. Most of the other devices connected to it belong to strangers and you’d probably prefer they not be able to see, connect to, or «discover» your device.

Network settings

When you select one of the three network types you’ll get the settings page for it. Here Windows Security will tell you which, if any, networks of that type you’re currently connected to. Usually your computer will only be connected to one network at a time.

You’ll also find a simple slider for turning the firewall on, or off, for that type of network.

Important: Turning the firewall off may increase the risk to your device or data. We recommend leaving it on unless you absolutely need to turn it off.

Under the Incoming connections section you’ll find a single checkbox for Blocks all incoming connections, including those in the list of allowed apps. Checking this box tells the Microsoft Defender Firewall to ignore the allowed apps list and block everything. Turning this on increases your security, but may cause some apps to stop working.

Also on the Firewall & network protection page:

Allow an app through firewall — If the firewall is blocking an app you really need, you can add an exception for that app, or open a specific port. Learn more about that process (and why you might not want to) at Risks of allowing apps through Microsoft Defender Firewall.

Network and Internet troubleshooter — If you’re having general network connectivity issues you can use this troubleshooter to try and automatically diagnose and fix them.

Firewall notification settings — Want more notifications when your firewall blocks something? Fewer? Here’s where you can configure that.

Advanced settings — If you’re knowledgeable about firewall settings this will open the classic Windows Defender Firewall tool which lets you create inbound or outbound rules, connection security rules, and see monitoring logs for the firewall. Most users won’t want to dig into it that deeply; adding, changing, or deleting rules incorrectly can cause your system to be more vulnerable or can cause some apps not to work.

Restore firewalls to default — If someone, or something, has made changes to your Windows Firewall settings that is causing things not to work properly you’re just two clicks away from resetting the settings back to the way they were when you first got the computer. If your organization has applied any policies to configure the firewall those will be reapplied.

Configure the Windows Firewall to Allow SQL Server Access

Applies to: SQL Server (all supported versions) — Windows only Azure SQL Managed Instance

Firewall systems help prevent unauthorized access to computer resources. If a firewall is turned on but not correctly configured, attempts to connect to SQL Server might be blocked.

To access an instance of the SQL Server through a firewall, you must configure the firewall on the computer that is running SQL Server. The firewall is a component of Microsoft Windows. You can also install a firewall from another company. This article discusses how to configure the Windows firewall, but the basic principles apply to other firewall programs.

This article provides an overview of firewall configuration and summarizes information of interest to a SQL Server administrator. For more information about the firewall and for authoritative firewall information, see the firewall documentation, such as Windows Firewall security deployment guide.

Users familiar with managing the Windows Firewall, and know which firewall settings they want to configure can move directly to the more advanced articles:

Basic Firewall Information

Firewalls work by inspecting incoming packets, and comparing them against the following set of rules:

• The packet meets the standards dictated by the rules, then the firewall passes the packet to the TCP/IP protocol for more processing.
• The packet doesn’t meet the standards specified by the rules.
  • The firewall then discards the packet.- If logging is enabled, an entry is created in the firewall logging file.

The list of allowed traffic is populated in one of the following ways:

Automatically: When a computer with a firewall enabled starts communication, the firewall creates an entry in the list so that the response is allowed. The response is considered solicited traffic, and there’s nothing that needs to be configured.

Manually: An administrator configures exceptions to the firewall. It allows either access to specified programs or ports on your computer. In this case, the computer accepts unsolicited incoming traffic when acting as a server, a listener, or a peer. The configuration must be completed to connect to SQL Server.

Choosing a firewall strategy is more complex than just deciding if a given port should be open or closed. When designing a firewall strategy for your enterprise, make sure you consider all the rules and configuration options available to you. This article doesn’t review all the possible firewall options. We recommend you review the following documents:

Default Firewall Settings

The first step in planning your firewall configuration is to determine the current status of the firewall for your operating system. If the operating system was upgraded from a previous version, the earlier firewall settings may have been preserved. The Group Policy or Administrator can change the firewall settings in the domain.

Turning on the firewall will affect other programs that access this computer, such as file and print sharing, and remote desktop connections. Administrators should consider all applications that are running on the computer before adjusting the firewall settings.

Programs to Configure the Firewall

Configure the Windows Firewall settings with either Microsoft Management Console or netsh.

Microsoft Management Console (MMC)

The Windows Firewall with Advanced Security MMC snap-in lets you configure more advanced firewall settings. This snap-in presents most of the firewall options in an easy-to-use manner, and presents all firewall profiles. For more information, see Using the Windows Firewall with Advanced Security Snap-in later in this article.

netsh

The netsh.exe is an Administrator tool to configure and monitor Windows-based computers at a command prompt or using a batch file**.** By using the netsh tool, you can direct the context commands you enter to the appropriate helper, and the helper does the command. A helper is a Dynamic Link Library (.dll) file that extends the functionality. The helper provides: configuration, monitoring, and support for one or more services, utilities, or protocols for the netsh tool.

All operating systems that support SQL Server have a firewall helper. Windows Server 2008 also has an advanced firewall helper called advfirewall. Many of the configuration options described can be configured by using netsh. For example, run the following script at a command prompt to open TCP port 1433:

A similar example using the Windows Firewall for Advanced Security helper:

For more information about netsh, see the following links:

PowerShell

See the following example to open TCP port 1433 and UDP port 1434 for SQL Server default instance, and SQL Server Browser Service:

For Linux: On Linux, you also need to open the ports associated with the services you need access to. Different distributions of Linux and different firewalls have their own procedures. For two examples, see SQL Server on Red Hat, and SQL Server on SUSE.

Ports Used By SQL Server

The following tables can help you identify the ports being used by SQL Server.

Ports Used By the Database Engine

By default, the typical ports used by SQL Server and associated database engine services are: TCP 1433, 4022, 135, 1434, UDP 1434. The table below explains these ports in greater detail. A named instance uses dynamic ports.

The following table lists the ports that are frequently used by the Database Engine.

Scenario	Port	Comments
Default instance running over TCP	TCP port 1433	The most common port allowed through the firewall. It applies to routine connections to the default installation of the Database Engine, or a named instance that is the only instance running on the computer. (Named instances have special considerations. See Dynamic Ports later in this article.)
Named instances with default port	The TCP port is a dynamic port determined at the time the Database Engine starts.	See the discussion below in the section Dynamic Ports. UDP port 1434 might be required for the SQL Server Browser Service when you’re using named instances.
Named instances with fixed port	The port number configured by the administrator.	See the discussion below in the section Dynamic Ports.
Dedicated Admin Connection	TCP port 1434 for the default instance. Other ports are used for named instances. Check the error log for the port number.	By default, remote connections to the Dedicated Administrator Connection (DAC) aren’t enabled. To enable remote DAC, use the Surface Area Configuration facet. For more information, see Surface Area Configuration.
SQL Server Browser service	UDP port 1434	The SQL Server browser service listens for incoming connections to a named instance.
The service provides the client the TCP port number that corresponds to that named instance. Normally the SQL Server Browser service is started whenever named instances of the Database Engine are used. The SQL Server Browser service isn’t required if the client is configured to connect to the specific port of the named instance.
Instance with HTTP endpoint.	Can be specified when an HTTP endpoint is created. The default is TCP port 80 for CLEAR_PORT traffic and 443 for SSL_PORT traffic.	Used for an HTTP connection through a URL.
Default instance with HTTPS endpoint	TCP port 443	Used for an HTTPS connection through a URL. HTTPS is an HTTP connection that uses Transport Layer Security (TLS), previously known as Secure Sockets Layer (SSL).
Service Broker	TCP port 4022. To verify the port used, execute the following query: SELECT name, protocol_desc, port, state_desc WHERE type_desc = ‘SERVICE_BROKER’	There’s no default port for SQL ServerService Broker, Books Online examples use the conventional configuration.
Database Mirroring	Administrator chosen port. To determine the port, execute the following query: SELECT name, protocol_desc, port, state_desc FROM sys.tcp_endpoints WHERE type_desc = ‘DATABASE_MIRRORING’	There’s no default port for database mirroring however Books Online examples use TCP port 5022 or 7022. It’s important to avoid interrupting an in-use mirroring endpoint, especially in high-safety mode with automatic failover. Your firewall configuration must avoid breaking quorum. For more information, see Specify a Server Network Address (Database Mirroring).
Replication	Replication connections to SQL Server use the typical regular Database Engine ports (TCP port 1433 is the default instance) Web synchronization and FTP/UNC access for replication snapshot require more ports to be opened on the firewall. To transfer initial data and schema from one location to another, replication can use FTP (TCP port 21), or sync over HTTP (TCP port 80) or File Sharing. File sharing uses UDP port 137 and 138, and TCP port 139 if used along with NetBIOS. File Sharing uses TCP port 445.	For sync over HTTP, replication uses the IIS endpoint (configurable; port 80 default), but the IIS process connects to the backend SQL Server through the standard ports (1433 for the default instance. During Web synchronization using FTP, the FTP transfer is between IIS and the SQL Server publisher, not between subscriber and IIS.
Transact-SQL debugger	TCP port 135 The IPsec exception might also be required.	If using Visual Studio, on the Visual Studio host computer, you must also add Devenv.exe to the Exceptions list and open TCP port 135. If using Management Studio, on the Management Studio host computer, you must also add ssms.exe to the Exceptions list and open TCP port 135. For more information, see Configure firewall rules before running the TSQL Debugger.

For step-by-step instructions to configure the Windows Firewall for the Database Engine, see Configure a Windows Firewall for Database Engine Access.

Dynamic Ports

By default, named instances (including SQL Server Express) use dynamic ports. means each time Database Engine starts, it identifies an available port and uses that port number. If the named instance is the only instance of the Database Engine installed, it will probably use TCP port 1433. If other instances of the Database Engine are installed, it will probably use a different TCP port. Because the port selected might change every time that the Database Engine is started, it’s difficult to configure the firewall to enable access to the correct port number. If a firewall is used, we recommend reconfiguring the Database Engine to use the same port number every time. A fixed port or a static port is recommended. For more information, see Configure a Server to Listen on a Specific TCP Port (SQL Server Configuration Manager).

An alternative to configuring a named instance to listen on a fixed port is to create an exception in the firewall for a SQL Server program such as sqlservr.exe (for the Database Engine). The port number won’t appear in the Local Port column of the Inbound Rules page when you’re using the Windows Firewall with Advanced Security MMC snap-in. It can be difficult to audit which ports are open. Another consideration is that a service pack or cumulative update can change the path to the SQL Server executable file and invalidate the firewall rule.

To add a program exception to the firewall using Windows Defender Firewall with Advanced Security

From the start menu, type wf.msc. Press Enter or select the search result wf.msc to open Windows Defender Firewall with Advanced Security.

In the left pane, select Inbound rules.

In the right pane, under Actions, select New rule. . New Inbound Rule Wizard opens.

On Rule type, select Program. Select Next.

On Program, select This program path. Select Browse to locate your instance of SQL Server. The program is called sqlservr.exe. It’s normally located at:

C:\Program Files\Microsoft SQL Server\MSSQL15. \MSSQL\Binn\sqlservr.exe

Select Next.

On Action, select Allow the connection. Select Next.

On Profile, include all three profiles. Select Next.

On Name, type a name for the rule. Select Finish.

Ports Used By Analysis Services

By default, the typical ports used by SQL Server Analysis Services and associated services are: TCP 2382, 2383, 80, 443. The table below explains these ports in greater detail.

The following table lists the ports that are frequently used by Analysis Services.

Feature	Port	Comments
Analysis Services	TCP port 2383 for the default instance	The standard port for the default instance of Analysis Services.
SQL Server Browser service	TCP port 2382 only needed for an Analysis Services named instance	Client connection requests for a named instance of Analysis Services that don’t specify a port number are directed to port 2382, the port on which SQL Server Browser listens. SQL Server Browser then redirects the request to the port that the named instance uses.
Analysis Services configured for use through IIS/HTTP (The PivotTableВ® Service uses HTTP or HTTPS)	TCP port 80	Used for an HTTP connection through a URL.
Analysis Services configured for use through IIS/HTTPS (The PivotTableВ® Service uses HTTP or HTTPS)	TCP port 443	Used for an HTTPS connection through a URL. HTTPS is an HTTP connection that uses TLS.

If users access Analysis Services through IIS and the Internet, you must open the port on which IIS is listening. Next, specify port in the client connection string. In this case, no ports have to be open for direct access to Analysis Services. The default port 2389, and port 2382, should be restricted together with all other ports that aren’t required.

For step-by-step instructions to configure the Windows Firewall for Analysis Services, see Configure the Windows Firewall to Allow Analysis Services Access.

Ports Used By Reporting Services

By default, the typical ports used by SQL Server Reporting Services and associated services are: TCP 80, 443. The table below explains these ports in greater detail.

The following table lists the ports that are frequently used by Reporting Services.

Feature	Port	Comments
Reporting Services Web Services	TCP port 80	Used for an HTTP connection to Reporting Services through a URL. We recommend that you don’t use the preconfigured rule World Wide Web Services (HTTP). For more information, see the Interaction with Other Firewall Rules section below.
Reporting Services configured for use through HTTPS	TCP port 443	Used for an HTTPS connection through a URL. HTTPS is an HTTP connection that uses TLS. We recommend that you don’t use the preconfigured rule Secure World Wide Web Services (HTTPS). For more information, see the Interaction with Other Firewall Rules section below.

When Reporting Services connects to an instance of the Database Engine or Analysis Services, you must also open the appropriate ports for those services. For step-by-step instructions to configure the Windows Firewall for Reporting Services, Configure a Firewall for Report Server Access.

Ports Used By Integration Services

The following table lists the ports that are used by the Integration Services service.

Feature	Port	Comments
Microsoft remote procedure calls (MS RPC) Used by the Integration Services runtime.	TCP port 135 See Special Considerations for Port 135	The Integration Services service uses DCOM on port 135. The Service Control Manager uses port 135 to do tasks such as starting and stopping the Integration Services service and transmitting control requests to the running service. The port number cannot be changed. This port is only required to be open if you’re connecting to a remote instance of the Integration Services service from Management Studio or a custom application.

For step-by-step instructions to configure the Windows Firewall for Integration Services, see Integration Services Service (SSIS Service).

Another Ports and Services

The following table lists ports and services that SQL Server might depend on.

Scenario	Port	Comments
Windows Management Instrumentation For more information about Windows Management Instrumentation (WMI), see WMI Provider for Configuration Management Concepts	WMI runs as part of a shared service host with ports assigned through DCOM. WMI might be using TCP port 135. See Special Considerations for Port 135	SQL Server Configuration Manager uses WMI to list and manage services. We recommend that you use the preconfigured rule group Windows Management Instrumentation (WMI). For more information, see the Interaction with Other Firewall Rules section below.
Microsoft Distributed Transaction Coordinator (MS DTC)	TCP port 135 See Special Considerations for Port 135	If your application uses distributed transactions, you might have to configure the firewall to allow Microsoft Distributed Transaction Coordinator (MS DTC) traffic to flow between separate MS DTC instances, and between the MS DTC and resource managers such as SQL Server. We recommend that you use the preconfigured Distributed Transaction Coordinator rule group. When a single shared MS DTC is configured for the entire cluster in a separate resource group, you should add sqlservr.exe as an exception to the firewall.
The browse button in Management Studio uses UDP to connect to the SQL Server Browser Service. For more information, see SQL Server Browser Service (Database Engine and SSAS).	UDP port 1434	UDP is a connectionless protocol. The firewall has a setting (UnicastResponsesToMulticastBroadcastDisabled Property of the INetFwProfile Interface) which controls the behavior of the firewall and unicast responses to a broadcast (or multicast) UDP request. It has two behaviors: If the setting is TRUE, no unicast responses to a broadcast are permitted at all. Enumerating services will fail. If the setting is FALSE (default), unicast responses are permitted for 3 seconds. The length of time isn’t configurable. In a congested or high-latency network, or for heavily loaded servers, tries to enumerate instances of SQL Server might return a partial list, which might mislead users.
IPsec traffic	UDP port 500 and UDP port 4500	If the domain policy requires network communications to be done through IPsec, you must also add UDP port 4500 and UDP port 500 to the exception list. IPsec is an option using the New Inbound Rule Wizard in the Windows Firewall snap-in. For more information, see Using the Windows Firewall with Advanced Security Snap-in below.
Using Windows Authentication with Trusted Domains	Firewalls must be configured to allow authentication requests.	For more information, see How to configure a firewall for domains and trusts.
SQL Server and Windows Clustering	Clustering requires extra ports that aren’t directly related to SQL Server.	For more information, see Enable a network for cluster use.
URL namespaces reserved in the HTTP Server API (HTTP.SYS)	Probably TCP port 80, but can be configured to other ports. For general information, see Configuring HTTP and HTTPS.	For SQL Server specific information about reserving an HTTP.SYS endpoint using HttpCfg.exe, see About URL Reservations and Registration (SSRS Configuration Manager).

Special Considerations for Port 135

When you use RPC with TCP/IP or with UDP/IP as the transport, inbound ports are dynamically assigned to system services as required. TCP/IP and UDP/IP ports that are larger than port 1024 are used. The ports are referred to as «random RPC ports.» In these cases, RPC clients rely on the RPC endpoint mapper to tell them which dynamic ports were assigned to the server. For some RPC-based services, you can configure a specific port instead of letting RPC assign one dynamically. You can also restrict the range of ports that RPC dynamically assigns to a small range, independent of the service. Because port 135 is used for many services, it’s frequently attacked by malicious users. When opening port 135, consider restricting the scope of the firewall rule.

For more information about port 135, see the following references:

Interaction with Other Firewall Rules

The Windows Firewall uses rules and rule groups to establish its configuration. Each rule or rule group is associated with a particular program or service, and that program or service might modify or delete that rule without your knowledge. For example, the rule groups World Wide Web Services (HTTP) and World Wide Web Services (HTTPS) are associated with IIS. Enabling those rules will open ports 80 and 443, and SQL Server features that depend on ports 80 and 443 will function if those rules are enabled. However, administrators configuring IIS might modify or disable those rules. If you’re using port 80 or port 443 for SQL Server, you should create your own rule or rule group that maintains your preferred port configuration independently of the other IIS rules.

The Windows Firewall with Advanced Security MMC snap-in allows any traffic that matches any applicable allow rule. So if there are two rules that both apply to port 80 (with different parameters). Traffic that matches either rule will be permitted. So if one rule allows traffic over port 80 from local subnet and one rule allows traffic from any address, the net effect is that all traffic to port 80 is independent of the source. To effectively manage access to SQL Server, administrators should periodically review all firewall rules enabled on the server.

Overview of Firewall Profiles

Firewall profiles are used by the operating systems to identify and remember each of the networks by: connectivity, connections, and category.

There are three network location types in Windows Firewall with Advanced Security:

• Domain: Windows can authenticate access to the domain controller for the domain to which the computer is joined.
• Public: Other than domain networks, all networks are initially categorized as public. Networks that represent direct connections to the Internet or are in public locations, such as airports and coffee shops should be left public.
• Private: A network identified by a user or application as private. Only trusted networks should be identified as private networks. Users will likely want to identify home or small business networks as private.

The administrator can create a profile for each network location type, with each profile containing different firewall policies. Only one profile is applied at any time. Profile order is applied as follows:

1. The domain profile is applied if all interfaces are authenticated to the domain controller where the computer is a member.
2. If all interfaces are either authenticated to the domain controller or are connected to networks that are classified as private network locations, the private profile is applied.
3. Otherwise, the public profile is applied.

Use the Windows Firewall with Advanced Security MMC snap-in to view and configure all firewall profiles. The Windows Firewall item in Control Panel only configures the current profile.

Additional Firewall Settings Using the Windows Firewall Item in Control Panel

The added firewall can restrict the opening of the port to incoming connections from specific computers or local subnet. Limit the scope of the port opening to reduce how much your computer is exposed to malicious users.

Using the Windows Firewall item in Control Panel only configures the current firewall profile.

To change the scope of a firewall exception using the Windows Firewall item in Control Panel

In the Windows Firewall item in Control Panel, select a program or port on the Exceptions tab, and then select Properties or Edit.

In the Edit a Program or Edit a Port dialog box, select Change Scope.

Choose one of the following options:

Any computer (including computers on the Internet): Not recommended. Any computer that can address your computer to connect to the specified program or port. This setting might be necessary to allow information to be presented to anonymous users on the internet, but increases your exposure to malicious users. Enabling this setting an allow Network Address Translation (NAT) traversal, such as the Allow edge traversal option will increase exposure.

My network (subnet) only: A more secure setting than Any computer. Only computers on the local subnet of your network can connect to the program or port.

Custom list: Only computers that have the IP addresses listed can connect. A secure setting can be more secure than My network (subnet) only, however, client computers using DHCP can occasionally change their IP address; will disable the ability to connect. Another computer, which you had not intended to authorize, might accept the listed IP address and connect to it. The Custom list is appropriate for listing other servers that are configured to use a fixed IP address. IP addresses can be spoofed by an intruder. Restricting firewall rules are only as strong as your network infrastructure.

Using the Windows Firewall with Advanced Security Snap-in

Advanced firewall settings can be configured by using the Windows Firewall with Advanced Security MMC snap-in. The snap-in includes a rule wizard and settings that aren’t available in the Windows Firewall item in Control Panel. These settings include:

• Encryption settings
• Services restrictions
• Restricting connections for computers by name
• Restricting connections to specific users or profiles
• Edge traversal allowing traffic to bypass Network Address Translation (NAT) routers
• Configuring outbound rules
• Configuring security rules
• Requiring IPsec for incoming connections

To create a new firewall rule using the New Rule wizard

1. On the Start menu, select Run, type WF.msc, and then select OK.
2. In the Windows Firewall with Advanced Security, in the left pane, right-click Inbound Rules, and then select New Rule.
3. Complete the New Inbound Rule Wizard using the settings that you want.

Troubleshooting Firewall Settings

The following tools and techniques can be useful in troubleshooting firewall issues:

The effective port status is the union of all rules related to the port. It can be helpful to review all the rules that cite the port number, when trying to block access to a port. Review the rules with the Windows Firewall with Advanced Security MMC snap-in and sort the inbound and outbound rules by port number.

Review the ports that are active on the computer on which SQL Server is running. The review process includes verifying which TCP/IP ports are listening and also verifying the status of the ports.

To verify which ports are listening, display active TCP connections and IP statistics use the netstat command-line utility.

To list which TCP/IP ports are listening

Open the Command Prompt window.

At the command prompt, type netstat -n -a.

The -n switch instructs netstat to numerically display the address and port number of active TCP connections. The -a switch instructs netstat to display the TCP and UDP ports on which the computer is listening.

The PortQry utility can be used to report the status of TCP/IP ports as listening, not listening, or filtered. (The utility may not receive response from the port if it has a filtered status.) The PortQry utility is available for download from the Microsoft Download Center.