Open a Firewall Port on Windows for SQL Server, PostgreSQL, MySQL or Oracle

Connector setup · Windows Firewall

Open a firewall port on Windows

When the Agent runs on a different computer from your database, Windows on the database server has to let it in. This page adds that one rule, click by click, for SQL Server, PostgreSQL, MySQL, MariaDB and Oracle, and shows how to test it.

Około 10 minut Windows database server One port, nothing else

Co z tego wyjdzie?

One inbound rule in Windows Defender Firewall on the computer that holds your database, allowing the database’s port and nothing else, and a test from the Agent’s computer that answers TcpTestSucceeded : True. Następnie Połączenie testowe in the Portal can reach the database.

Which port to open

Use the port shown in the connector form’s Port box. If nobody changed it when the database was installed, it is the default:

Add the rule

Do this on the computer that holds the database, signed in as an administrator. The example opens TCP 1433; type your own port in step 6.

1. Open the advanced firewall window

   Kliknij Start, type wf.msc i naciśnij Enter. If Windows asks Do you want to allow this app to make changes to your device?, kliknij Tak. A window titled Windows Defender Firewall with Advanced Security opens, with a list on the left, a summary in the middle and an Actions list on the right.

2. Go to Inbound Rules

   In the list on the left, click Inbound Rules. The middle fills with a long list of existing rules; you do not need to touch any of them.

3. Start a new rule

   W Actions list on the right, click New Rule…. Ten New Inbound Rule Wizard opens on the Rule Type page, which asks What type of rule would you like to create?

4. Choose Port

   Kliknij Port (“Rule that controls connections for a TCP or UDP port”), then click Następny. The wizard moves to Protocol and Ports.

5. Choose TCP

   Pod Does this rule apply to TCP or UDP?, leave TCP selected. (Choose UDP only for the SQL Server Browser rule, port 1434, in the named-instance section.)

6. Type the port

   Pod Does this rule apply to all local ports or specific local ports?, wybierać Specific local ports: and type the port in the box, for example 1433. Just the number, no spaces. Click Następny.

7. Allow the connection

   Ten Action page asks What action should be taken when a connection matches the specified conditions? Wyjechać Allow the connection selected and click Następny.

8. Pick when it applies

   Ten Profil page asks When does this rule apply? with three tick boxes: Domain, Private oraz Public. Leave all three ticked unless whoever looks after your network says otherwise; Windows decides which one is in force, and a server that lands on the wrong one would quietly block the Agent. Click Następny.

9. Name it and finish

   On the Nazwa page, type a name you will recognise later, for example Query Streams Agent – SQL Server 1433i kliknij Skończyć. The wizard closes and your rule appears in the Inbound Rules list with a green tick beside it. It works straight away; nothing needs restarting.

Ports for each database

Microsoft SQL Server

A default SQL Server instance listens on TCP 1433, the port the connector form starts with. Add one rule for TCP 1433 with the steps above. If your server name in the connector has no backslash in it (just SERVER or an address), this is all you need.

If the test in the Portal says Connection failed: nothing answered on SERVER:1433. SQL Server is not listening on that port, or a firewall between the agent and the server blocks it., it is either this rule or SQL Server’s own TCP/IP setting; test the port to tell which.

SQL Server named instances and SQL Express

If the server name has a backslash, like OFFICE-SERVER\SQLEXPRESS, it is a named instance. A named instance does not use 1433: it picks its own port, and a helper called the Przeglądarka SQL Server tells the Agent which one on UDP 1434. So it needs two rules: one for UDP 1434, and one for the instance’s TCP port.

1. Open SQL Server Configuration Manager

   On the database server, click Start and type SQL Server Configuration Manager. If nothing appears, type the file name for your SQL Server version instead and press Enter: SQLServerManager16.msc for SQL Server 2022, SQLServerManager15.msc for 2019, SQLServerManager14.msc for 2017, SQLServerManager17.msc for 2025. Click Tak if Windows asks for permission.

2. Open TCP/IP for your instance

   In the list on the left, expand SQL Server Network Configuration i kliknij Protocols for SQLEXPRESS (your instance’s name after “for”). On the right, check TCP/IP says Włączony; if it says Disabled, right-click it and choose Enable first. Then double-click TCP/IP. A box titled TCP/IP Properties opens.

3. Read the port under IPAll

   Kliknij przycisk IP Addresses tab and scroll to the very bottom, to the section headed IPAll. It has two boxes: TCP Dynamic Ports oraz TCP Port.

   Jeśli TCP Port has a number, that is the instance’s fixed port: use it. If TCP Port is empty and TCP Dynamic Ports shows a number such as 49172, that is the port it chose this time, and it can change after a restart. Make it fixed: delete the number in TCP Dynamic Ports so the box is empty, type a port in TCP Port (the number it already had is fine, or 1433 if nothing else on the server uses it), and click OK.

4. Restart the instance

   In the list on the left, click SQL Server Services. On the right, right-click SQL Server (SQLEXPRESS) i wybierz Restart. A progress box appears for a few seconds. The new port only takes effect after this restart. Anyone using the database is disconnected for those seconds, so pick a quiet moment.

5. Start SQL Server Browser

   In the same SQL Server Services list, find Przeglądarka SQL Server. If its state is not Running, double-click it, open the Service tab, set Start Mode do Automatic, kliknij Apply, then right-click Przeglądarka SQL Server i wybierz Start.

6. Add the two firewall rules

   Podążać Add the rule twice: once with TCP and the port from step 3, once with UDP oraz 1434. Name them so you can tell them apart, for example Query Streams Agent – SQLEXPRESS oraz Query Streams Agent – SQL Browser.

In the connector form, keep the server as OFFICE-SERVER\SQLEXPRESS i Port Jak 1433; the Browser finds the real port. Or type the fixed port from step 3 in Port instead, in which case the UDP 1434 rule and the Browser are not needed.

If the test says Connection failed: instance "SQLEXPRESS" was not found on OFFICE-SERVER, one of these six steps is still missing: TCP/IP enabled, restarted, Browser running, or one of the two rules.

PostgreSQL

One rule for TCP 5432. PostgreSQL also refuses other computers until it is told to listen for them, in its own settings files (postgresql.conf oraz pg_hba.conf); if the port test below succeeds and the connection still fails, that is the next place to look, and whoever installed PostgreSQL will know them.

MySQL and MariaDB

One rule for TCP 3306. If the Agent’s test says Connection to MySQL server timed out after … seconds. The server may be unreachable or the port may be blocked by a firewall., this rule is the first suspect. MySQL also has its own bind-address setting that can limit it to the server itself.

Oracle

One rule for TCP 1521, the default listener port shown in the connector form. TNS:connect timeout occurred lub TNS:destination host unreachable in the test usually means the rule is missing; TNS:no listener – Oracle listener may not be running means the port is reachable but the listener on the server is stopped.

Test the port from the Agent’s computer

This answers one question: can the Agent’s computer reach that port on the server? Run it on the computer where the Agent is installed, not on the server.

1. Open PowerShell

   On the Agent’s computer, click Start, type PowerShelli kliknij Windows PowerShell. A blue or black window opens with a line ending in >. No administrator rights are needed.

2. Run the test

   Type the line below, with your server’s name or address instead of OFFICE-SERVER and your port instead of 1433, then press Enter. For a named instance use just the part before the backslash, and the port from IPAll.

   Type this, then press Enter

   Test-NetConnection -ComputerName OFFICE-SERVER -Port 1433

   It takes a few seconds, up to about half a minute when the port is blocked, then prints a short list.

3. Read the last line

   TcpTestSucceeded : True means the port is open and something is listening. The firewall is not the problem; go back to the Portal and click Połączenie testowe. If that still fails, the message is about the login or the database, not the network.

   TcpTestSucceeded : False, usually with a yellow line above it reading WARNING: TCP connect to (… : 1433) failed, means nothing answered. Either the rule is missing or wrong, or the database is not listening on that port: check that next.

   Name resolution of OFFICE-SERVER failed, with no TcpTestSucceeded line at all, means this computer cannot find a server by that name. Check the spelling, or use the server’s IP address instead.

When it is not the firewall

If the test says False even with the rule in place, check that the database is actually listening on that port. On the database server, otwarty Command Prompt (click Start, type cmd, kliknij Command Prompt) and type, with your port:

netstat -an | findstr 1433

• A line like TCP 0.0.0.0:1433 0.0.0.0:0 LISTENING means the database is listening for every computer. The firewall rule (or a second firewall, such as antivirus software or the network’s own) is what blocks it; check the port number in your rule.
• Only TCP 127.0.0.1:1433 … LISTENING means the database listens to the server itself only. That is a database setting, not the firewall: TCP/IP in SQL Server Configuration Manager, listen_addresses dla PostgreSQL, bind-address for MySQL and MariaDB.
• Nothing at all means nothing listens on that port: the database service is stopped, it uses a different port, or (SQL Server) TCP/IP is disabled. For a named instance, read the real port in IPAll.

Test nieudany?

Messages about a login, a password or a database name mean the network part already works; this page cannot fix those. Create a read-only database user covers the login side.

Powiązane przewodniki

• Create a read-only database user
• Is the Agent online?
• Microsoft SQL Server to Excel
• PostgreSQL do Excel
• MySQL do Excel
• Oracle do Excel
• Microsoft: Configure the Windows Firewall to allow SQL Server access
• Wszystkie przewodniki