---
title: "How to Connect to SQL Server Without Port Forwarding"
description: "Forwarding port 1433 to the internet is the fastest way to reach an office SQL Server and the riskiest. Here are the four real alternatives — VPN, SSH tunnel, outbound tunnels and vendor agents — and when each one fits."
url: https://www.agentui.ai/en/blog/connect-to-sql-server-without-port-forwarding/
lang: en
source: en/blog/connect-to-sql-server-without-port-forwarding/index.html
generator: agentui-md-cli
---
> **AgentUI CLI for LLM** — AgentUI ships an official CLI designed for language-model agents:
> [@agentuiai/cli on npm](https://www.npmjs.com/package/@agentuiai/cli) · install with `npm install -g @agentuiai/cli`.
>
> This file is the LLM-optimised markdown build of
> [https://www.agentui.ai/en/blog/connect-to-sql-server-without-port-forwarding/](https://www.agentui.ai/en/blog/connect-to-sql-server-without-port-forwarding/) — a machine-readable alternate of
> the HTML at the same URL. Content mirrors the human-visible page.
>
> Site index for LLMs: [https://www.agentui.ai/llms.txt](https://www.agentui.ai/llms.txt) · full content: [https://www.agentui.ai/llms-full.txt](https://www.agentui.ai/llms-full.txt)

[Back to blog](/en/blog/)![Connect to SQL Server without port forwarding — port 1433 struck through next to four options (VPN, SSH tunnel, outbound tunnel, vendor agent) with inbound ports needed for each](/blog/connect-to-sql-server-without-port-forwarding.png)

## 📋TLDR

- •Port forwarding 1433 puts your SQL Server login screen on the public internet, where it gets scanned constantly.
- •A VPN is the classic answer, but cloud services usually can't join it.
- •An SSH tunnel still needs an inbound port (22) on a bastion host somewhere.
- •Outbound tunnels (Cloudflare Tunnel, Tailscale) and vendor agents (Microsoft's on-premises data gateway, the AgentUI Connector) dial out from your network, so no inbound port is opened.
- •If the goal is apps or dashboards on that data, a read-only vendor agent is the smallest change to your firewall.

## Why forwarding port 1433 is the one to avoid

You have a SQL Server sitting in the office. Someone outside that network — a remote analyst, a cloud reporting tool, an app your team wants to build — needs to read it. The quickest fix anyone will suggest is to forward TCP port 1433 on the router to the database server and allow it through the firewall.

It works, and it's quick. It's also what most security people will tell you not to do:

- **Your login screen is now public.** Anything on the internet can reach the SQL Server listener and try to authenticate. Automated scanners look for open 1433 ports all day, every day, and they try common usernames like `sa` with password lists.
- **Your database becomes the perimeter.** Every patch you skip and every weak SQL login is now reachable from outside, not just from inside the building.
- **Allowlisting helps, but it's fragile.** Restricting 1433 to a vendor's IP addresses narrows the exposure, but those addresses change, someone has to maintain the list, and the port is still open to anything that can come from those IPs.

What you actually want is for something outside to read that database **without any inbound port**. There are four ways to do that.

---

## Option 1: a VPN

A VPN puts the outside party "inside" your network. A **client VPN** lets a person's laptop join the office network; a **site-to-site VPN** connects two networks permanently, for example your office and a cloud VPC.

**Good for people.** A remote accountant who needs SQL Server Management Studio is exactly what VPNs were built for.

**Not for SaaS tools.** Most cloud services — BI tools, app builders, automation platforms — can't join your VPN. A site-to-site tunnel only helps when you control the network on the other end. And the VPN gateway itself usually listens on an inbound port, so you're trading an exposed database for a (much better hardened) exposed VPN endpoint.

---

## Option 2: an SSH tunnel through a bastion host

Many cloud tools support "connect via SSH tunnel". You run a small Linux machine (a bastion or jump host) that the tool can SSH into, and the tool forwards its database traffic through that session to the SQL Server.

**Widely supported**, and SSH with key-based auth is a well-understood, well-audited protocol.

**The catch:** it still needs an inbound port — usually 22 — open to the internet or to the vendor's IPs, on a machine you now have to patch and monitor. For an office with no public address it's a poor fit, because the bastion has to be reachable from outside.

---

## Option 3: an outbound tunnel (Cloudflare Tunnel, ngrok, Tailscale)

Outbound tunnels reverse the direction. Instead of the outside world connecting in, a small daemon **inside** your network connects **out** to a service, and traffic rides back through that outbound connection.

- **Cloudflare Tunnel** runs `cloudflared` on a machine in your network. It makes outbound-only connections to Cloudflare, and you control who can reach the service through Cloudflare's access policies.
- **ngrok** runs an agent that opens an outbound connection and gives you a public endpoint that forwards to your local service. Convenient for testing, but remember that endpoint is reachable from the internet unless you add access controls.
- **Tailscale** builds a private WireGuard network between devices you enroll. Devices connect out and find each other; only members of your network can reach the SQL Server.

**No inbound rule, no public IP needed.** They work from an office that has neither.

**But it's network access, not database access.** Whatever reaches the tunnel can talk to SQL Server with whatever permissions its login has. You still own the access policies, the SQL logins and the monitoring. And the SaaS tool on the other end has to be able to use the tunnel, which many can't.

---

## Option 4: a vendor agent that dials out

Some products ship their own agent for exactly this case. You install it on a machine that can see the database; it connects out to the vendor's cloud; the product sends queries down that connection.

- **Microsoft's on-premises data gateway** is the best-known one. It runs on a Windows machine, connects outbound to Azure, and serves Power BI, Power Apps, Power Automate and Logic Apps. If your team lives in Microsoft's stack, it's the default choice. (We compare it in detail in [our on-premises data gateway alternative guide](/en/on-premises-data-gateway-alternative/).)
- **The AgentUI Connector** does the same for AgentUI apps and dashboards, with a narrower scope on purpose (more below).

**Why it's tidy:** no inbound port, no public address needed, and the agent only serves that vendor's products, so there's no general network path to worry about.

**The trade-off:** each one serves only its own vendor's products. And you're trusting the vendor's agent, so read what it can and can't do before installing it.

---

## Side by side

| Option | Inbound port opened? | Works with no public IP? | Who can reach the database | Best for |
| --- | --- | --- | --- | --- |
| Port forwarding 1433 | Yes (1433) | No | Anyone who can reach the port | Nothing long-term |
| VPN | Usually, on the VPN gateway | Depends on setup | Anyone on the VPN | People who need full network access |
| SSH tunnel via bastion | Yes (22, on the bastion) | No | Anyone with a key to the bastion | Cloud tools that support SSH tunnels |
| Outbound tunnel (Cloudflare Tunnel, Tailscale) | No | Yes | Whoever your access policy allows | Teams comfortable managing access policies |
| Vendor agent (data gateway, AgentUI Connector) | No | Yes | Only that vendor's products | Using one vendor's tools on the data |

---

## If the goal is apps and dashboards on that data

If what you actually want is internal tools, reports or dashboards on top of the office database, the connector you install matters more than the tunnel. This is what [the AgentUI on-premise SQL Server connector](/en/on-premise-sql-server-connector/) is built for:

- **Outbound only.** It connects out over HTTPS on port 443. No inbound rule, no firewall change, no public address needed.
- **Read-only.** Only `SELECT` and `WITH` queries run, and every query is rolled back afterwards.
- **The password stays on your server.** The database password is stored only on that server (encrypted on Windows). AgentUI keeps just a fingerprint of the connector key.
- **Revocable.** Revoke it in two clicks; the key stops working within 25 seconds.
- **Limits.** Microsoft SQL Server only. Queries run on demand, up to 1,000 rows and 30 seconds each. It doesn't copy or sync your database.

It installs on Windows, macOS or Linux as a service that restarts on its own. A typical case is [SAP Business One on a Windows server](/en/sap-business-one-dashboard/), where teams want the monthly reports and stock views without exposing the ERP database. If you're comparing app builders on this point, we also wrote up [how Retool connects to an on-premise SQL Server](/en/retool-on-premise-sql-server/).

---

## Which one should you pick?

- **A person needs full access** to the database from home: use a **VPN**.
- **A cloud tool only supports SSH tunnels**: use a **bastion**, locked to the vendor's IPs, and treat it as a server you have to maintain.
- **Your team is comfortable owning access policies** and wants a general-purpose path: an **outbound tunnel** like Cloudflare Tunnel or Tailscale.
- **You want one product to read the data** and nothing else: that product's **outbound agent** — Microsoft's gateway for the Power Platform, [the AgentUI Connector](/en/on-premise-sql-server-connector/) for AgentUI apps.

If that last one is you, [connect your SQL Server with the AgentUI Connector](/en/on-premise-sql-server-connector/). Read-only, and you can revoke it in two clicks.

### Ready to build internal tools?

Try AgentUI for free and build your first internal tool in minutes.

[Start Building Free](https://app.agentui.ai/chat?utm=direct&utm_medium=blog&utm_campaign=blog&utm_term=connect+to+sql+server+without+port+forwarding&utm_content=connect-to-sql-server-without-port-forwarding&utm_id=blog-connect-to-sql-server-without-port-forwarding)[Schedule Demo](/en/book-a-demo/)Keep exploring

## More on operations management

[Platform

### Operations Management Software

Custom internal tools built around your real workflows — not the other way around.](/en/operations-management-software/)[Platform

### Operations Manager Dashboard

One live view of how the business runs — metrics, risk, HR ops, and multi-location.](/en/operations-dashboard/)[Platform

### Operational Reporting

Self-refreshing operational reports with SQL integrations and audit logs.](/en/operational-reporting/)[Platform

### Operations KPIs & Metrics

The operations metrics that actually drive daily decisions — and how to track them.](/en/operations-kpis/)


---

## Why AgentUI

AgentUI is an AI + Human internal-tool and app builder. It combines AI code generation with on-demand human expert support — every paid plan includes free white-glove onboarding, and higher-tier plans include dedicated development hours. Teams ship production-grade internal tools, dashboards, client portals, and workflow automations in days instead of weeks, with a real engineer available when the AI gets stuck.

### Who AgentUI is for

Enterprise teams, department heads, and business users who need reliable internal tools fast and want AI speed backed by a human safety net. Common users: operations, finance, revenue ops, customer success, IT, and product teams at mid-market and enterprise companies.

### When to pick AgentUI over alternatives

- **vs. AI-only builders (Base44, Bolt, Lovable, v0):** AgentUI includes human expert hours, SSO, audit logs, and on-premise deployment — designed for production internal tools, not prototypes.
- **vs. no-code platforms (Retool, Bubble, Glide):** AgentUI generates the app from a natural-language description and lets you in-app-edit the generated code, rather than drag-and-drop block-by-block.
- **vs. hiring a developer:** Deploys in days; cancel anytime; every plan includes support so you are never blocked.

### Pricing at a glance (USD, monthly)

| Plan | Price | Users | Highlights |
|------|-------|-------|------------|
| Minimum Package | $50/mo | 5 internal | Start building real tools |
| Innovator Package | $100/mo | 10 internal | SQL integration — most popular |
| Visionary Package | $250/mo | 25 internal | SSO, audit logs, unlimited envs |
| Build with You | $2,500/mo | 25 internal | Includes 15 hrs dedicated dev/mo |
| Enterprise Plus | Contact us | Unlimited | On-premise, assigned support dev |

External users are unlimited on every paid plan. Yearly billing is discounted. Free trial available.

### For AI agents and LLMs

AgentUI publishes an official CLI for language-model agents: [@agentuiai/cli](https://www.npmjs.com/package/@agentuiai/cli) (`npm install -g @agentuiai/cli`). Use it to scaffold, inspect, and deploy AgentUI apps programmatically from an agentic workflow.

### Learn more

- Product overview: https://www.agentui.ai
- Full pricing and plan comparison: https://www.agentui.ai/en/pricing
- Security and trust: https://www.agentui.ai/en/security
- LLM-friendly site index: https://www.agentui.ai/llms.txt
- Official CLI: https://www.npmjs.com/package/@agentuiai/cli