Open a Firewall Port on Windows for SQL Server, PostgreSQL, MySQL or Oracle

Connector setup · Windows Firewall

Open a firewall port on Windows

When the Agent runs on a different computer from your database, Windows on the database server has to let it in. This page adds that one rule, click by click, for SQL Server, PostgreSQL, MySQL, MariaDB and Oracle, and shows how to test it.

約10分 Windows database server One port, nothing else

最終的に手に入るもの

One inbound rule in Windows Defender Firewall on the computer that holds your database, allowing the database’s port and nothing else, and a test from the Agent’s computer that answers TcpTestSucceeded : True。 それから 接続テスト in the Portal can reach the database.

Which port to open

Use the port shown in the connector form’s ポート box. If nobody changed it when the database was installed, it is the default:

Add the rule

Do this on the computer that holds the database, signed in as an administrator. The example opens TCP 1433; type your own port in step 6.

1. Open the advanced firewall window

   クリック Start, type wf.msc そして押す Enter. If Windows asks Do you want to allow this app to make changes to your device?、 クリック はい. A window titled Windows Defender Firewall with Advanced Security opens, with a list on the left, a summary in the middle and an Actions list on the right.

2. Go to Inbound Rules

   In the list on the left, click Inbound Rules. The middle fills with a long list of existing rules; you do not need to touch any of them.

3. Start a new rule

   では Actions list on the right, click New Rule…. New Inbound Rule Wizard opens on the Rule Type page, which asks What type of rule would you like to create?

4. Choose Port

   クリック ポート (“Rule that controls connections for a TCP or UDP port”), then click 次のページ. The wizard moves to Protocol and Ports.

5. Choose TCP

   下 Does this rule apply to TCP or UDP?, leave TCP selected. (Choose UDP only for the SQL Server Browser rule, port 1434, in the named-instance section.)

6. Type the port

   下 Does this rule apply to all local ports or specific local ports?、 選ぶ Specific local ports: and type the port in the box, for example 1433. Just the number, no spaces. Click 次のページ.

7. Allow the connection

   の Action page asks What action should be taken when a connection matches the specified conditions? 離れる Allow the connection selected and click 次のページ.

8. Pick when it applies

   の プロフィール page asks When does this rule apply? with three tick boxes: Domain, Private そして Public. Leave all three ticked unless whoever looks after your network says otherwise; Windows decides which one is in force, and a server that lands on the wrong one would quietly block the Agent. Click 次のページ.

9. Name it and finish

   On the 名称 page, type a name you will recognise later, for example Query Streams Agent – SQL Server 1433、そしてクリック 仕上げる. The wizard closes and your rule appears in the Inbound Rules list with a green tick beside it. It works straight away; nothing needs restarting.

Ports for each database

マイクロソフトSQLサーバー

A default SQL Server instance listens on TCP 1433, the port the connector form starts with. Add one rule for TCP 1433 with the steps above. If your server name in the connector has no backslash in it (just SERVER or an address), this is all you need.

If the test in the Portal says Connection failed: nothing answered on SERVER:1433. SQL Server is not listening on that port, or a firewall between the agent and the server blocks it., it is either this rule or SQL Server’s own TCP/IP setting; test the port to tell which.

SQL Server named instances and SQL Express

If the server name has a backslash, like OFFICE-SERVER\SQLEXPRESS, it is a named instance. A named instance does not use 1433: it picks its own port, and a helper called the SQL Server Browser tells the Agent which one on UDP 1434. So it needs two rules: one for UDP 1434, and one for the instance’s TCP port.

1. Open SQL Server Configuration Manager

   On the database server, click Start and type SQL Server Configuration Manager. If nothing appears, type the file name for your SQL Server version instead and press Enter: SQLServerManager16.msc for SQL Server 2022, SQLServerManager15.msc for 2019, SQLServerManager14.msc for 2017, SQLServerManager17.msc for 2025. Click はい if Windows asks for permission.

2. Open TCP/IP for your instance

   In the list on the left, expand SQL Server Network Configuration そしてクリック Protocols for SQLEXPRESS (your instance’s name after “for”). On the right, check TCP/IP says 有効; if it says Disabled, right-click it and choose Enable first. Then double-click TCP/IP. A box titled TCP/IP Properties opens.

3. Read the port under IPAll

   をクリックする。 IP Addresses tab and scroll to the very bottom, to the section headed IPAll. It has two boxes: TCP Dynamic Ports そして TCP Port.

   もし TCP Port has a number, that is the instance’s fixed port: use it. If TCP Port is empty and TCP Dynamic Ports shows a number such as 49172, that is the port it chose this time, and it can change after a restart. Make it fixed: delete the number in TCP Dynamic Ports so the box is empty, type a port in TCP Port (the number it already had is fine, or 1433 if nothing else on the server uses it), and click わかりました.

4. Restart the instance

   In the list on the left, click SQL Server Services. On the right, right-click SQL Server (SQLEXPRESS) そして選択する Restart. A progress box appears for a few seconds. The new port only takes effect after this restart. Anyone using the database is disconnected for those seconds, so pick a quiet moment.

5. Start SQL Server Browser

   In the same SQL Server Services list, find SQL Server Browser. If its state is not Running, double-click it, open the Service tab, set Start Mode ～へ Automatic、 クリック Apply, then right-click SQL Server Browser そして選択する Start.

6. Add the two firewall rules

   フォローする Add the rule twice: once with TCP and the port from step 3, once with UDP そして 1434. Name them so you can tell them apart, for example Query Streams Agent – SQLEXPRESS そして Query Streams Agent – SQL Browser.

In the connector form, keep the server as OFFICE-SERVER\SQLEXPRESS そして ポート として 1433; the Browser finds the real port. Or type the fixed port from step 3 in ポート instead, in which case the UDP 1434 rule and the Browser are not needed.

If the test says Connection failed: instance "SQLEXPRESS" was not found on OFFICE-SERVER, one of these six steps is still missing: TCP/IP enabled, restarted, Browser running, or one of the two rules.

PostgreSQL

One rule for TCP 5432. PostgreSQL also refuses other computers until it is told to listen for them, in its own settings files (postgresql.conf そして pg_hba.conf); if the port test below succeeds and the connection still fails, that is the next place to look, and whoever installed PostgreSQL will know them.

MySQL and MariaDB

One rule for TCP 3306. If the Agent’s test says Connection to MySQL server timed out after … seconds. The server may be unreachable or the port may be blocked by a firewall., this rule is the first suspect. MySQL also has its own bind-address setting that can limit it to the server itself.

オラクル

One rule for TCP 1521, the default listener port shown in the connector form. TNS:connect timeout occurred または TNS:destination host unreachable in the test usually means the rule is missing; TNS:no listener – Oracle listener may not be running means the port is reachable but the listener on the server is stopped.

Test the port from the Agent’s computer

This answers one question: can the Agent’s computer reach that port on the server? Run it on the computer where the Agent is installed, not on the server.

1. Open PowerShell

   On the Agent’s computer, click Start, type PowerShell、そしてクリック Windows PowerShell. A blue or black window opens with a line ending in >. No administrator rights are needed.

2. Run the test

   Type the line below, with your server’s name or address instead of OFFICE-SERVER and your port instead of 1433, then press Enter. For a named instance use just the part before the backslash, and the port from IPAll.

   Type this, then press Enter

   Test-NetConnection -ComputerName OFFICE-SERVER -Port 1433

   It takes a few seconds, up to about half a minute when the port is blocked, then prints a short list.

3. Read the last line

   TcpTestSucceeded : True means the port is open and something is listening. The firewall is not the problem; go back to the Portal and click 接続テスト. If that still fails, the message is about the login or the database, not the network.

   TcpTestSucceeded : False, usually with a yellow line above it reading WARNING: TCP connect to (… : 1433) failed, means nothing answered. Either the rule is missing or wrong, or the database is not listening on that port: check that next.

   Name resolution of OFFICE-SERVER failed, with no TcpTestSucceeded line at all, means this computer cannot find a server by that name. Check the spelling, or use the server’s IP address instead.

When it is not the firewall

If the test says False even with the rule in place, check that the database is actually listening on that port. On the database server、 開ける Command Prompt (click Start, type cmd、 クリック Command Prompt) and type, with your port:

netstat -an | findstr 1433

• A line like TCP 0.0.0.0:1433 0.0.0.0:0 LISTENING means the database is listening for every computer. The firewall rule (or a second firewall, such as antivirus software or the network’s own) is what blocks it; check the port number in your rule.
• Only TCP 127.0.0.1:1433 … LISTENING means the database listens to the server itself only. That is a database setting, not the firewall: TCP/IP in SQL Server Configuration Manager, listen_addresses PostgreSQLの場合、 bind-address for MySQL and MariaDB.
• Nothing at all means nothing listens on that port: the database service is stopped, it uses a different port, or (SQL Server) TCP/IP is disabled. For a named instance, read the real port in IPAll.

テストは失敗しましたか？

Messages about a login, a password or a database name mean the network part already works; this page cannot fix those. Create a read-only database user covers the login side.

関連ガイド

• Create a read-only database user
• Is the Agent online?
• Microsoft SQL Server to Excel
• PostgreSQLからExcelへ
• MySQLからExcelへ
• オラクルからエクセルへ
• Microsoft: Configure the Windows Firewall to allow SQL Server access
• すべてのガイド