Question: Which firewall ports are needed for SQL Server log shipping?
Answer: A client with a tightly controlled network asked me for a single port list before configuring log shipping. I initially expected that to be easy to find. The difficulty is that log shipping is several connections, not one protocol: a backup job writes a log backup, a copy job reads it across a file share, and restore and monitoring jobs connect to SQL Server instances. The right answer starts by drawing those routes.
| Connection to allow | Typical port | Why |
|---|---|---|
| Secondary copy job to the backup share | TCP 445 for modern SMB | The secondary must read the transaction-log backup files from the UNC share. Grant the job or service account the required share and file permissions. |
| Administration or monitoring to each SQL Server instance | The instance’s actual TCP listener, often 1433 for a default instance | SSMS, jobs, and monitor connections need the port configured for their target instance. A named instance may use a different port. |
| Named-instance discovery, if used | UDP 1434 | SQL Server Browser can resolve a named instance’s port. A known static port and explicit connection can avoid dependence on discovery. |
The direction matters. The SMB connection usually runs from the secondary server toward the share, which may live on the primary or on another file server. SQL connections follow whichever administration and monitor path you actually configure. Test each route using the same account and destination that the job will use, then run a backup, copy, and restore cycle.
My old list called TCP 135 mandatory for SQL Agent to copy the backup, and mixed legacy NetBIOS ports 137 to 139 into the universal requirement. That overstates the case. The usual file-copy route is SMB over TCP 445; TCP 135 is associated with separate RPC or management scenarios, not the core copy job. Legacy file-sharing environments may have other requirements. Do not open those extra ports without a specific dependency.
Microsoft’s log-shipping security guidance explains the backup share and secondary copy account; its SQL Server firewall guide distinguishes instance ports, Browser discovery, SMB, and TCP 135. My client’s network team needed those specific source, destination, and port pairs, not an instruction to open every port in an old checklist.
Published by Pinal Dave on SQLAuthority. More of my work at pinaldave.com.
Discover more from SQL Authority with Pinal Dave
Subscribe to get the latest posts sent to your email.
