Forum Discussion
Memorable MemberDATAFLOW and ON-PREM DB connectivity solution
Advocate VElement115, I'm not 100% sure I understand what you mean with the statement:
"his case there is already one baked in the firewall--the open TCP/1433 to all traffic rule"
Are you saying that you basically have a firewall rule set up that allows TCP/1433 to anything internally from anything externally? Or are you only allowing anything externally to your gateway server? Or something else?
Memorable Membermotoray Yeah, sorry , that was poorly phrased and I edited my OP to make it more clear (hopefully ;-)).
But in a nutshell:
WAN (internet) Destination == all
Services (ie traffic restriction rules) going from the machine running the gateway out to the internet we do not specify any endpoint (ie wildcard FQDN) as in the MS documentation, rather only 0.0.0.0 for the endpoint over TCP on port 1433.
Which means, any local application generating TCP traffic over port 1433 will be allowed through the firewall and to its destination on the internet.
As to the converse, ie any TCP traffic over 1433 in the direction of the server running the data gateway on the LAN will have to pass through the Microsoft data gateway first. My sysadmin explained that the gateway filters all traffic over 1433 and thus takes care of accepting only legitimate 1433 traffic from Microsoft before relaying it to the DB server. This makes me wonder about the potential security implications, what about SQL injections and the like...?
- motoray
Thanks--that clears it up.
- Element115
.
Joshrodgers123We went through this craziness today.
We found that you also need to allow "*.pbidedicated.windows.net", not just "*.datawarehouse.pbidedicated.windows.net"