How do I open the firewall for my monitoring software to access WMI?

Question

I have a SQL Server machine and a monitoring machine, and I need the monitoring software on the monitor host to be able to read the WMI data on the SQL Server host. (The monitoring software is RedGate SQL Monitor). Both machines are running Windows Server 2008 R2.

I've tried multiple permutations of firewall rules to try and get to the two to connect, and I've successfully opened a few ports that it needed (such as 139 & 445 for Remote Registry). But I can't get port 135 to open, so the monitor can't connect to WMI. My latest attempt is this:

I have gone into the Local Computer Policy (these machines are on the same private network, but not part of any domain), and enabled the remote administration exception (per this TechNet article). This created a firewall rule that applies to the Private and Public profiles that allows traffic to port 135 only from the monitoring machine's private IP, for svchost.exe. (Windows firewall is setup in the standard way, blocking incoming and allowing outbound by default.) There are no other rules enabled that apply to 135 (either individually or in a range). And yet when I try to connect the monitor, it shows an error, and when I go into the Windows Firewall logs for the SQL machine, I can clearly see that port 135 is being blocked going from the monitor IP to the SQL IP.

#Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path
2015-04-07 10:22:43 DROP TCP <monitor_ip> <database_ip> 58866 135 52 S 1072620108 0 8192 - - - RECEIVE

I'm a DBA, so this isn't exactly my wheelhouse. Two sysadmins and I have been banging our heads against this for a week. Please help!

I've tried setting up WMI on a fixed port, not 135 (https://msdn.microsoft.com/en-us/library/bb219447%28v=vs.85%29.aspx) but I can't figure out how to get SQL Monitor to use it. — nateirvin, Apr 09 '15 at 16:31
I haven't made any changes to SQL Monitor to get it to accept my static WMI port. — Katherine Villyard, Apr 09 '15 at 17:44
It should be pointed out that without the firewall in place, the monitoring works perfectly. The issue appears to entirely with the firewall, and it's inexplicable blocking of port 135. — nateirvin, Apr 10 '15 at 15:50

score 0 · Accepted Answer · answered May 04 '15 at 17:49

So, in the end the only thing that worked was turning off the Windows Firewall Private Profile.

Before doing this, we modified settings (including disabling NetBIOS) so that there was no traffic being dropped (in that profile), so that having the profile off was pretty much the same as having it on. We monitored for several days before and after to be sure of that, too.

(We tried allowing inbound by default, and it still blocked 135, so we just disabled the whole profile.)

How do I open the firewall for my monitoring software to access WMI?

1 Answers1

Linked