The key recommendation for SharePoint 2013 is to secure communication among servers in a farm by blocking the default ports used for SQL Server communication and establishing custom ports for this communication instead. For services, lessen your attack surface area by disabling any service that is not required by your database servers.

Ports and protocols

There are several ports and protocols that are defined and required for SharePoint features and services to operate successfully and some of these should be modified for greater security.

Configuring Ports and Protocols

After securing the services on your web, application and database servers, you need to think about securing the ports that these servers use to communicate with one another in a SharePoint 2013 farm. Different SharePoint server roles use different ports to communicate with each other.

Securing service application communications

Communications among web servers and service applications in a farm environment use the following ports and protocol bindings by default:

Securing web server communications

The following are the default ports used by SharePoint web servers in a farm:

Securing database server communications

The following are the default ports used for SQL Server communications:

It is a best practice to block the TCP 1433 port on the SQL Server computer and configure a SQL Server client alias to connect to the named instance instead.

Securing search server communications

The following are the default ports used by the SharePoint Search indexing components within a farm:

Securing Active Directory communications

The following are the default ports used to synchronize user profiles between SharePoint 2013 and Active Directory Domain Services (AD DS) on the server that runs the Forefront Identity Management (FIM) agent:

Securing external server communications

There are some SharePoint 2013 features that can be configured to access data on servers that are external to the farm. In these scenarios, you need to ensure that the communication channels are open between the local server and the remote server. Typically, the ports and protocols used will depend on the Office Web Apps and Workflow Manager Port considerations. You should not block the following ports on any server that runs Office Web Apps Server, since Office Web Apps Server periodically removes web applications on these ports:

You should also review the IIS Manager to view the ports used by Workflow Manager to ensure that these are also available.

Configuring ports

There are several tools and technologies that you can use to configure ports and protocols for SharePoint 2013. However, if you are using the Windows Firewall with Advanced Security when you install SharePoint 2013, predefined inbound and outbound rules are automatically created to configure and open the appropriate ports on the firewall for the installed services and applications.