Skip to main content

Securing SQL Server: Disabling SQL Browser & Setting Static Ports

The SQL Server Browser service (UDP port 1434) is often targeted in DDoS amplification attacks. For a secure production environment, we recommend disabling this service completely.

The Risk:
If left open to the internet, attackers can abuse the SQL Browser service to flood victims with traffic. Tilaa may block this port if abuse is detected.
The Consequence:
Disabling the SQL Browser means clients can no longer "find" your Named Instance automatically (e.g., connecting to SERVER\SQLEXPRESS).
You must configure a Static TCP Port and specify that port in your connection string.

Step 1: Set a Static TCP Port

Before disabling the Browser service, ensure your instance listens on a fixed port so you can still connect.

  1. Open SQL Server Configuration Manager.
  2. Navigate to SQL Server Network Configuration > Protocols for [YOUR_INSTANCE].
  3. Right-click TCP/IP and select Properties.
  4. Go to the IP Addresses tab.
  5. Scroll down to the section IPAll.
  6. TCP Dynamic Ports: Remove the 0 (make it empty).
  7. TCP Port: Enter your desired port (e.g., 1433 for default or 7500 for custom).
  8. Click OK.
SQL Server IPAll configuration

Step 2: Disable SQL Server Browser

Now that we have a fixed port, we can safely kill the vulnerable service.

  1. In Configuration Manager, go to SQL Server Services.
  2. Right-click on SQL Server Browser and select Properties.
  3. On the Service tab, change Start Mode to Disabled.
  4. Click Stop to halt the service immediately.
Disabling SQL Browser Service

Finally, restart the main SQL Server service to apply the port changes.

Step 3: Connecting with a Static Port

Since the Browser service is gone, you must tell your applications exactly which port to use.

Connection String Example:

Server=myServerAddress,7500;Database=myDataBase;User Id=myUsername;Password=myPassword;

Note the comma (,) between the address and the port.

Step 4: Update Firewall

Don't forget to update your Windows Firewall!

  1. Allow TCP traffic on your chosen port (e.g., 7500).
  2. Block UDP port 1434 (SQL Browser) to prevent abuse.