skip to Main Content

First of all this does not contain my answer.

I want to find which firewall rule allows specific port 1433

In my server, Plesk has been installed and “MS SQL over TCP protocol” firewall rule is disabled. Somehow I can connect to the SQL Server from remote connection. There is one firewall rule allows 1433 TCP Connection but which one? Is there any command to find which firewall rule allows 1433.

2

Answers


  1. Source

    Run as administrator

    cls
    Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -Eq "1433" } | Get-NetFirewallRule |
    Format-Table -Autosize -Property DisplayName,
    @{Name='Protocol';Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},
    @{Name='LocalPort';Expression={($PSItem | Get-NetFirewallPortFilter).LocalPort}},
    @{Name='RemotePort';Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}},
    @{Name='RemoteAddress';Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}},
    Enabled, Profile, Direction, Action
    
    Login or Signup to reply.
  2. Easiest way to figure this out is through netevents.

    1. Start command line as administrator.
    2. Run netsh wfp cap start keywords=19
    3. Let the traffic flow through port 1433
    4. Run netsh wfp cap stop
    5. Open Wfpdiag.xml in Wfpdaig.cab generated by above step.
    6. Search for all NetEvents with <localPort>1433</localPort> and get filterId from <classifyAllow>
    7. Search for the filterId and the <displayData> should tell you which rule allowed the packet.
    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search