Port 1433 完整指南：SQL Server 默认端口、连接测试、防火墙、安全配置与故障排查

Q: Is SQL Server port 1433 TCP or UDP?

SQL Server database traffic on port 1433 normally uses TCP. UDP port 1434 is associated with SQL Server Browser, which helps clients discover the TCP port used by named instances.

Q: How do I check whether port 1433 is open?

Test from the same client network path as the application. On Windows, run Test-NetConnection with the authorized host and port 1433, then inspect TcpTestSucceeded. Confirm the actual instance port first.

Q: Does an open port 1433 prove that SQL Server works?

No. A successful TCP test proves only that the target accepted a network connection on that port. It does not validate authentication, permissions, TLS, database names, or query execution.

Q: Should port 1433 be exposed to the public internet?

Avoid broad public exposure. Prefer private networking, narrow source allowlists, encryption, least-privilege accounts, monitoring, and a documented need for each firewall rule.

What is port 1433 used for?1433 端口是做什么的？

Port 1433 is the conventional default TCP port for a default Microsoft SQL Server Database Engine instance. It is not guaranteed to be the active port. A named instance may choose a dynamic port, and an administrator can assign a different static port. Confirm the real listening port before changing a firewall rule.1433 是 Microsoft SQL Server 数据库引擎默认实例通常使用的 TCP 端口。但它不一定就是当前实例的真实端口：命名实例可能使用动态端口，管理员也可以设置其他静态端口。修改防火墙规则前，应先确认目标实例实际监听的端口。

TCPDatabase session transport数据库会话传输协议

1433Default instance convention默认实例常用端口

UDP 1434Browser discoveryBrowser 发现服务

1 pathTest from the real client从真实客户端测试

Port 1433 vs 1434: test the correct protocol1433 与 1434：应测试正确的协议

The similar numbers cause a common diagnostic mistake. SQL Server database connections normally use a TCP port. For a default instance, that is commonly TCP 1433. SQL Server Browser listens on UDP 1434 and tells a client which TCP port a named instance uses. Browser discovery is not the database session itself.两个端口数字接近，容易造成诊断误区。SQL Server 数据库连接通常使用 TCP 端口，默认实例常见为 TCP 1433。SQL Server Browser 监听 UDP 1434，用于告诉客户端命名实例使用哪个 TCP 端口。Browser 的发现过程并不是数据库会话本身。

Component组件	Typical port常见端口	Purpose用途	What to test应该测试什么
Default instance默认实例	TCP 1433	Database connections数据库连接	TCP path from the application从应用出发的 TCP 路径
Named instance命名实例	Dynamic or assigned TCP port动态或指定 TCP 端口	Database connections数据库连接	Discover the actual port first先确认真实端口
SQL Server Browser	UDP 1434	Instance-to-port discovery实例到端口的发现	Only when discovery is required仅在需要实例发现时检查

What an open port 1433 proves—and does not prove1433 开放能证明什么，不能证明什么

A successful TCP test provesTCP 测试成功可以证明

The tested client can resolve the target and complete a TCP connection to the selected host and port at that moment.被测试客户端在当时能够解析目标，并与指定主机和端口完成 TCP 连接。

It does not prove它不能证明

SQL authentication, database permissions, TLS compatibility, database names, application connection strings, query execution, or production readiness.SQL 身份验证、数据库权限、TLS 兼容性、数据库名、应用连接字符串、查询执行或生产可用性是否正常。

Use reachability as the first layer of a layered diagnosis: DNS, route, firewall, listening socket, TLS, authentication, authorization, and application behavior. This prevents the misleading conclusion that “the port is open, so SQL Server is healthy.”应把可达性作为分层诊断的第一步，后续还要检查 DNS、路由、防火墙、监听套接字、TLS、身份验证、授权和应用行为。这样可以避免“端口开着，所以 SQL Server 一定正常”的错误结论。

Collect four facts before testing port 1433测试 1433 前先确认四项信息

Exact host准确目标主机Use the same DNS name or private IP the application uses. Testing localhost answers a different question.使用应用实际连接的 DNS 名称或私有 IP；测试 localhost 不能代表真实路径。
Actual instance port实例真实端口Check SQL Server Configuration Manager or the error log. Do not assume a named instance uses 1433.通过 SQL Server Configuration Manager 或错误日志确认，不要假设命名实例一定使用 1433。
Real client network path真实客户端网络路径Run the test from the application host, subnet, VPN, container, or build agent that experiences the failure.从发生问题的应用主机、子网、VPN、容器或构建代理运行测试。
Authorization测试授权Test only approved systems. A port test needs a host and port—not a password, connection string, or production secret.只测试已授权系统。端口测试只需要主机和端口，不需要密码、连接字符串或生产密钥。

How to check if port 1433 is open如何检查 1433 端口是否开放

Confirm the listener确认监听服务Review TCP/IP settings and the error-log entry that reports the listening address and port. Restart the Database Engine if a configuration change requires it.检查 TCP/IP 设置及错误日志中的监听地址和端口。如果配置变更需要重启，应先重启数据库引擎。
Test from the affected client从受影响客户端测试Replace the placeholder below with an authorized DNS name or private IP. A true result confirms TCP reachability only for that source, destination, and moment.把下面的占位符替换为已授权的 DNS 名称或私有 IP。true 只代表该来源到目标在当时可达。
Use an explicit endpoint使用明确端点To bypass instance discovery, use tcp:server.example,1433. If the instance listens elsewhere, substitute the verified port.如需绕过实例发现，可使用 tcp:server.example,1433；若实例监听其他端口，应替换成已经核实的端口。
Continue above the network layer继续检查网络层之上If TCP succeeds but the application fails, inspect TLS, login method, account state, permissions, database name, driver, and connection-string options.如果 TCP 成功但应用仍失败，应检查 TLS、登录方式、账号状态、权限、数据库名、驱动和连接字符串选项。

PowerShell

# Run from the same network path as the application.
Test-NetConnection -ComputerName db.internal.example -Port 1433

# Inspect the network-layer result:
TcpTestSucceeded : True

Do not publish real hosts, IP addresses, credentials, or connection strings. Use sanitized values when sharing diagnostic evidence.不要公开真实主机、IP、凭据或连接字符串。共享诊断证据时请使用脱敏值。

Interpret common port 1433 test results解读常见的 1433 测试结果

Result结果	Likely meaning可能含义	Next check下一步
`TcpTestSucceeded: True`	TCP reached a listenerTCP 到达了监听服务	Test TLS, login, database selection, and permissions测试 TLS、登录、数据库选择和权限
Connection refused连接被拒绝	The target responded, but no listener accepted the port or a device actively rejected it目标有响应，但没有监听服务接受该端口，或设备主动拒绝	Verify service, port, binding, and local firewall核对服务、端口、绑定和本机防火墙
Timeout / filtered超时 / 被过滤	A firewall, route, VPN, security group, or ACL may drop packets防火墙、路由、VPN、安全组或 ACL 可能丢弃数据包	Trace source-to-destination policy from the correct subnet从正确子网逐层检查来源到目标的策略
DNS failureDNS 失败	The client cannot resolve the host客户端无法解析主机	Check private DNS, VPN, suffix, and spelling检查私有 DNS、VPN、后缀和拼写
Login or TLS error after TCP succeedsTCP 成功后登录或 TLS 报错	The network works; the failure is higher in the stack网络正常，故障位于更高层	Check certificates, encryption, authentication, driver, and permissions检查证书、加密、身份验证、驱动和权限

Why SQL Server port 1433 is not listening为什么 SQL Server 没有监听 1433

A missing 1433 listener does not automatically mean SQL Server is down. The instance may be healthy on another port. Check these causes in order:没有监听 1433 并不一定表示 SQL Server 宕机，实例可能在其他端口正常运行。建议依次检查：

Named instance: it may use a dynamic TCP port.命名实例：可能使用动态 TCP 端口。
TCP/IP disabled: the protocol may not be enabled for this instance.TCP/IP 未启用：该实例可能没有启用此协议。
Pending restart: a port change may not take effect until the service restarts.尚未重启：端口变更可能需要重启服务后生效。
Wrong IP binding: the expected interface may be disabled or configured differently.IP 绑定错误：目标网卡可能被禁用或配置不同。
Port conflict: another process may already own the configured port.端口冲突：其他进程可能已占用目标端口。

The SQL Server error log records which IP addresses and ports the server is listening on. That evidence is more reliable than assuming the default.SQL Server 错误日志会记录服务器监听的 IP 地址和端口，这比直接假设使用默认端口更可靠。

Configure access without overexposing port 1433配置访问权限，但不要过度暴露 1433

An inbound rule should be a narrow business exception, not blanket internet exposure. Define the verified destination and TCP port, approved source ranges, environment, owner, review date, and removal condition.入站规则应当是范围明确的业务例外，而不是面向互联网的无差别开放。应记录已核实的目标和 TCP 端口、允许来源、环境、负责人、复核日期和移除条件。

Preferred controls优先控制措施

Private networks, VPN or peering, source allowlists, segmentation, TLS, least-privilege accounts, monitoring, and expiring change records.私有网络、VPN 或对等连接、来源白名单、网络分段、TLS、最小权限账号、监控和到期变更记录。

Avoid应避免

Opening TCP 1433 to every source, embedding credentials in scripts, or leaving temporary rules active after testing.向所有来源开放 TCP 1433、在脚本中嵌入凭据，或测试后遗留临时规则。

Validate every layer after port 1433 becomes reachable1433 可达后还要逐层验证

A successful TCP connection is a useful boundary, but it is not the finish line. It shows that the tested client reached a listening process at the resolved address and port during that attempt. It does not identify the process as the intended SQL Server instance, prove that encryption policy can be negotiated, authenticate a login, select the expected database, authorize an operation, or show that a query returns correct results. Preserve the endpoint, source network, timestamp, resolved address, and command output so the result can be compared with application logs rather than remembered informally.TCP 连接成功是一个有用的边界，但不是排障终点。它只能说明在该次测试中，客户端到达了解析地址和端口上的监听进程；它不能证明该进程就是目标 SQL Server 实例，也不能证明加密策略可以协商、登录能够认证、目标数据库可以选择、操作已获授权或查询结果正确。应保存端点、来源网络、时间戳、解析地址和命令输出，以便与应用日志对照，而不是依赖口头记忆。

Validation layer验证层	Evidence of success成功证据	If it fails失败时检查
Name resolution名称解析	The hostname resolves to the approved address for the intended environment.主机名解析到目标环境批准的地址。	DNS suffix, private zone, VPN context, stale cache, and split-horizon records.DNS 后缀、私有区域、VPN 上下文、陈旧缓存和分区解析记录。
TCP reachabilityTCP 可达性	A connection to the verified host and configured SQL Server TCP port succeeds.到已核实主机及 SQL Server 配置端口的连接成功。	Listener binding, routing, firewall, security group, network ACL, and source allowlist.监听绑定、路由、防火墙、安全组、网络 ACL 和来源白名单。
TLS and pre-loginTLS 与预登录	The driver and server agree on encryption and the certificate is valid for policy and hostname.驱动和服务器完成加密协商，且证书符合策略与主机名要求。	Driver version, trust chain, certificate name, expiry, protocol version, and encryption settings.驱动版本、信任链、证书名称、有效期、协议版本和加密设置。
Authentication身份认证	The intended Windows, SQL, federated, or workload identity is accepted.目标 Windows、SQL、联合或工作负载身份被接受。	Authentication mode, account state, credential source, clock, identity mapping, and sanitized error code.认证模式、账号状态、凭据来源、时钟、身份映射和脱敏错误码。
Database authorization数据库授权	The login maps to the intended database user and can perform only the required operation.登录映射到目标数据库用户，并且只能执行所需操作。	Default database, user mapping, roles, explicit denies, object grants, and row-level policy.默认数据库、用户映射、角色、显式拒绝、对象授权和行级策略。

Run the application-level test from the same execution context as the failing workload whenever possible. A successful administrator test from a laptop may use a different DNS resolver, route, source address, driver, certificate store, identity, or connection string. Match the real workload before concluding that port 1433 is healthy. If a temporary firewall exception is used to isolate the cause, give it an owner and expiry, record the before-and-after result, then remove it promptly.条件允许时，应从与故障工作负载相同的执行环境进行应用层测试。管理员在笔记本上的成功测试可能使用不同的 DNS 解析器、路由、来源地址、驱动、证书存储、身份或连接字符串，因此不能据此直接认定 1433 端口健康。若使用临时防火墙例外来隔离原因，应设置负责人和到期时间，记录变更前后结果，并及时移除。

Check the SQL Server endpoint before deeper debugging深入排错前先检查 SQL Server 端点

Use the InfiniSynapse DB Compatibility Checker to verify TCP reachability for an authorized SQL Server host and port. For SQL Server, this check is limited to the network endpoint: it does not validate credentials, TLS, permissions, or query execution.使用 InfiniSynapse DB Compatibility Checker 检查已授权 SQL Server 主机与端口的 TCP 可达性。对于 SQL Server，该检查仅限网络端点，不会验证凭据、TLS、权限或查询执行。

Open DB Compatibility Checker打开数据库兼容性检查工具 Use only authorized, sanitized endpoint information. Do not paste secrets.只使用已授权且脱敏的端点信息，请勿粘贴密钥。

A practical decision tree for port 1433 failures1433 端口故障的实用决策路径

Can the client resolve the hostname?客户端能否解析主机名？If no, fix DNS, VPN, or the endpoint before inspecting SQL Server.如果不能，先修复 DNS、VPN 或端点，再检查 SQL Server。
Is the verified TCP port reachable?已核实的 TCP 端口是否可达？If no, distinguish refusal from timeout, then inspect listener, routing, firewall, security group, and source allowlist.如果不可达，先区分拒绝与超时，再检查监听、路由、防火墙、安全组和来源白名单。
Can the SQL client complete TLS and authentication?SQL 客户端能否完成 TLS 与身份验证？If TCP passes but the client fails, focus on certificates, encryption, login method, account state, and driver behavior.如果 TCP 成功而客户端失败，应重点检查证书、加密、登录方式、账号状态和驱动行为。
Can the account access the intended database?账号能否访问目标数据库？Validate the database name, default database, mappings, roles, and least-privilege permissions.验证数据库名、默认数据库、用户映射、角色和最小权限。

Port 1433 FAQ1433 端口常见问题

What is port 1433 used for?1433 端口是做什么的？

TCP port 1433 is the conventional default port for a default Microsoft SQL Server Database Engine instance. Named instances may use dynamic ports, and administrators can assign another static port.TCP 1433 是 SQL Server 数据库引擎默认实例通常使用的端口。命名实例可能使用动态端口，管理员也可指定其他静态端口。

Is SQL Server port 1433 TCP or UDP?SQL Server 1433 是 TCP 还是 UDP？

Database traffic on 1433 normally uses TCP. UDP 1434 is associated with SQL Server Browser and named-instance discovery.1433 上的数据库流量通常使用 TCP；UDP 1434 与 SQL Server Browser 和命名实例发现有关。

How do I check whether port 1433 is open?如何检查 1433 是否开放？

From the application's network path, run Test-NetConnection with the authorized host and verified port, then inspect TcpTestSucceeded.从应用的真实网络路径，对已授权主机和已核实端口运行 Test-NetConnection，再查看 TcpTestSucceeded。

Why is SQL Server port 1433 not listening?为什么 SQL Server 没监听 1433？

The instance may use a dynamic or custom port, TCP/IP may be disabled, a restart may be pending, or the test may target the wrong interface.实例可能使用动态或自定义端口，TCP/IP 可能未启用，服务可能尚未重启，也可能测试了错误网卡。

Does an open port 1433 prove that SQL Server works?开放 1433 端口是否代表 SQL Server 正常？

No. It proves TCP reachability only, not authentication, permissions, TLS, database names, or query execution.不能。它只证明 TCP 可达，不能证明身份验证、权限、TLS、数据库名或查询执行正常。

Should port 1433 be exposed to the public internet?应该把 1433 端口暴露到公网吗？

Avoid broad public exposure. Prefer private networking, strict source allowlists, encryption, least privilege, and monitoring.应避免大范围公网暴露，优先采用私有网络、严格来源白名单、加密、最小权限和监控。

Official Microsoft referencesMicrosoft 官方参考资料

Port behavior and troubleshooting guidance were verified against Microsoft documentation. InfiniSynapse product claims are limited to the tool's stated TCP reachability scope.端口行为与排错建议已依据 Microsoft 官方文档核验；InfiniSynapse 产品描述严格限定在工具声明的 TCP 可达性检查范围内。