0

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts on my SQL Server database, presumably from scripts which are trying to brute force the SA account.

I decided that this is no big deal, I will just use Windows Firewall to block incoming TCP requests on Port 1433 (the port that SQL Server uses). However, after adding the inbound security rule, I noticed that my web application no longer works. It's as if the rule is blocking the web application from accessing SQL Server, but this seems strange to me because both the web application and the SQL Server database are running on the same virtual machine - why would Windows Firewall affect it?

Sure enough, when I disable the newly added rule, the web application is working again. Can anyone help explain to me what's going on here? Maybe I am misunderstanding how Windows Firewall works.

Thank you.

Improve this question
7
  • Even though the web application and the SQL server are on the same machine the web application still makes a TCP connection to localhost (its own IP) using port 1433. You need to write your firewall rules to disallow traffic to port 1433 originating from an IP other than your own IP and 127.0.0.1. – Daisetsu Mar 25 '19 at 18:57
  • @Daisetsu I suspected that as well, but it seems that Windows Firewall does not block the localhost/loopback address (superuser.com/questions/401900/…) – Matthew Mar 25 '19 at 19:28
  • in your web app where you list the connection information to your SQL server, are you specifying 127.0.0.1/localhost or is it using your public IP? – Daisetsu Mar 25 '19 at 19:30
  • @Daisetsu Public IP - is that the problem? – Matthew Mar 25 '19 at 19:30
  • use 127.0.0.1 instead. – Daisetsu Mar 25 '19 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.