Direct SQL Server Connections and Port 1433

Issue:

Does opening the default Microsoft SQL Server port (1433) to a production Power Pick database represents a high-value attack surface? Is there an alternative architecture or approach that reduces security risk while still enabling ItemPath to connect?

Resolution:

ItemPath requires a direct network connection to your Power Pick SQL Server via an IP address to sync data. This architecture is standard across our customer base for both on-premise and cloud deployments.However, you do not need to open port 1433 to the public internet. You retain complete control over the network path and can implement several network-level controls to minimize security risk.

Network Isolation via IP Whitelisting

The most common approach is to configure your firewall rules so that the Power Pick database only accepts traffic from the specific, verified IP address of your ItemPath instance. All other traffic attempting to reach that port is automatically blocked and dropped.

Changing the Default SQL Server Port

You can reconfigure your Microsoft SQL Server instance hosting the Power Pick data to listen to a non-standard, custom port instead of the default 1433. You would then update your connection settings in ItemPath to target this new custom port, which prevents automated "post-scanning" attacks.

NAT and Port Forwarding

You can use a firewall, router, or reverse proxy to act as a buffer. In this setup, ItemPath connects to a specific external IP address and a custom port. Your network hardware then safely forwards (NATs) that traffic to the actual internal IP address and port of your production Power Pick SQL Server

Integrations

Alerts