SQL Ports 1433 and 1434
You set up sql ports 1433 and 1434 by opening TCP 1433 for traffic and UDP 1434 for lookup. The configured port handles main database queries, while the configured port helps apps find named instances. Teams often open both ports to wide internal subnets so apps can log in fast. Broad network rules and shared database roles let anyone on the network run risky queries. How sql ports 1433 and 1434 route database traffic Database servers use network ports to listen for client traffic. TCP the co
SQL Query Filtering: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up sql ports 1433 and 1434 by opening TCP 1433 for traffic and UDP 1434 for lookup. The configured port handles main database queries, while the configured port helps apps find named instances. Teams often open both ports to wide internal subnets so apps can log in fast. Broad network rules and shared database roles let anyone on the network run risky queries.
How sql ports 1433 and 1434 route database traffic
Database servers use network ports to listen for client traffic. TCP the configured port is the standard port for the default database instance. When a client app knows this port, it sends queries straight to the server. The server reads the request and sends back the data over the same path.
Many teams run more than one database instance on a single machine. Each named instance listens on a different TCP port that can change on restart. UDP the configured port runs a lookup service that tracks these changing ports. When a client asks for a named instance, it sends a short note to UDP 1434. The lookup service replies with the exact TCP port that the named instance uses right now.
TCP the configured port has a separate job for admin rescue tasks. Database admins use TCP 1434 when the main server stops taking normal queries. Most teams keep TCP 1434 restricted to local server logins only.
How to set up firewall rules for database ports
Network teams start by checking if the server runs a single default instance. If it does, they only open TCP the configured port on the host firewall. They leave UDP the configured port closed and turn off the lookup service. This simple step cuts down the network footprint of the database host.
When a host runs named instances, teams have two main paths. First, they can open UDP 1434 and the full range of dynamic TCP ports. Second, they can assign a fixed TCP port to each named instance. Assigning a fixed port is safer because teams only open that single TCP port. They can then keep UDP 1434 closed to outside networks.
SQL Query Filtering: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Good firewall rules also limit which source IP addresses can reach the database. Only specific app servers and admin machines should pass the network firewall.
What port rules solve and the gap they leave open
Strict port rules stop random machines on the network from reaching your database listener. They block basic port scans and keep unauthorized hosts from trying to log in. Pairing fixed ports with server roles also defines who can open a session.
Still, network ports and login roles only check access at the start of a session. Once a user or app logs in over TCP 1433, the firewall steps aside. It does not inspect the actual SQL statements moving across the wire. A developer with a valid login can still run a broad delete command by mistake. A shared app role can still pull raw emails, phone numbers, or card numbers. Port controls cannot rewrite sensitive fields in query results or pause a risky statement in flight.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between TCP 1433 and UDP 1434?
TCP 1433 carries actual database sessions and SQL queries for the default instance. UDP 1434 runs a lookup service that tells clients which port a named instance uses.
Do I need to open the configured port if I only use the default instance?
No, you do not need the configured port open for a default instance. Clients can reach the default instance directly over TCP the configured port without the lookup service.
How can I avoid opening UDP 1434 for named instances?
You can assign a static TCP port to each named instance in your server settings. Then give that exact port number to your client apps and close UDP 1434.