Skip to content

Commit f3b7fff

Browse files
andreasjordanandreasjordan
authored
New-/Get-/Remove-DbaFirewallRule: New rule for database mirroring or Availability Groups (#9846)
1 parent 0cdac05 commit f3b7fff

File tree

3 files changed

+67
-5
lines changed

3 files changed

+67
-5
lines changed

‎public/Get-DbaFirewallRule.ps1‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ function Get-DbaFirewallRule {
2929
* Engine - Returns firewall rules for the SQL Server Database Engine service
3030
* Browser - Returns firewall rules for the SQL Server Browser service (UDP 1434)
3131
* DAC - Returns firewall rules for the Dedicated Admin Connection
32+
* DatabaseMirroring - Returns firewall rules for database mirroring or Availability Groups
3233
* AllInstance - Returns all SQL Server-related firewall rules on the target computer
3334
3435
When omitted, returns Engine and DAC rules for the specified instance, plus Browser rules if the instance uses a non-standard port.
@@ -79,7 +80,7 @@ function Get-DbaFirewallRule {
7980
[parameter(Mandatory, ValueFromPipeline)]
8081
[DbaInstanceParameter[]]$SqlInstance,
8182
[PSCredential]$Credential,
82-
[ValidateSet('Engine', 'Browser', 'DAC', 'AllInstance')]
83+
[ValidateSet('Engine', 'Browser', 'DAC', 'DatabaseMirroring', 'AllInstance')]
8384
[string[]]$Type,
8485
[switch]$EnableException
8586
)
@@ -183,6 +184,10 @@ function Get-DbaFirewallRule {
183184
$typeName = 'DAC'
184185
$instanceName = 'MSSQLSERVER'
185186
$sqlInstanceName = $instance.ComputerName
187+
} elseif ($rule.Name -eq 'SQL Server default instance (DatabaseMirroring)') {
188+
$typeName = 'DatabaseMirroring'
189+
$instanceName = 'MSSQLSERVER'
190+
$sqlInstanceName = $instance.ComputerName
186191
} elseif ($rule.Name -eq 'SQL Server default instance') {
187192
$typeName = 'Engine'
188193
$instanceName = 'MSSQLSERVER'
@@ -191,6 +196,10 @@ function Get-DbaFirewallRule {
191196
$typeName = 'DAC'
192197
$instanceName = $rule.Name -replace '^SQL Server instance (.+) \(DAC\)$', '$1'
193198
$sqlInstanceName = $instance.ComputerName + '\' + $instanceName
199+
} elseif ($rule.Name -match 'SQL Server instance .+ \(DatabaseMirroring\)') {
200+
$typeName = 'DatabaseMirroring'
201+
$instanceName = $rule.Name -replace '^SQL Server instance (.+) \(DatabaseMirroring\)$', '$1'
202+
$sqlInstanceName = $instance.ComputerName + '\' + $instanceName
194203
} elseif ($rule.Name -match 'SQL Server instance .+') {
195204
$typeName = 'Engine'
196205
$instanceName = $rule.Name -replace '^SQL Server instance (.+)$', '$1'
@@ -241,6 +250,10 @@ function Get-DbaFirewallRule {
241250
Write-Message -Level Verbose -Message 'Returning rule for DAC'
242251
$outputRules += $rules | Where-Object { $_.Type -eq 'DAC' -and $_.InstanceName -eq $instance.InstanceName }
243252
}
253+
if ('DatabaseMirroring' -in $Type) {
254+
Write-Message -Level Verbose -Message 'Returning rule for DatabaseMirroring'
255+
$outputRules += $rules | Where-Object { $_.Type -eq 'DatabaseMirroring' -and $_.InstanceName -eq $instance.InstanceName }
256+
}
244257
}
245258
$outputRules | Select-DefaultView -Property ComputerName, InstanceName, SqlInstance, DisplayName, Type, Protocol, LocalPort, Program
246259
}

‎public/New-DbaFirewallRule.ps1‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,16 @@ function New-DbaFirewallRule {
5454
The firewall rule for the DAC will only be created if the DAC is configured for listening remotely.
5555
Use `Set-DbaSpConfigure -SqlInstance SRV1 -Name RemoteDacConnectionsEnabled -Value 1` to enable remote DAC before running this command.
5656
57+
The firewall rule for database mirroring or Availability Groups will have the following configuration (parameters for New-NetFirewallRule):
58+
59+
DisplayName = 'SQL Server default instance (DatabaseMirroring)' or 'SQL Server instance <InstanceName> (DatabaseMirroring)'
60+
Name = 'SQL Server default instance (DatabaseMirroring)' or 'SQL Server instance <InstanceName> (DatabaseMirroring)'
61+
Group = 'SQL Server'
62+
Enabled = 'True'
63+
Direction = 'Inbound'
64+
Protocol = 'TCP'
65+
LocalPort = '5022' (can be overwritten by using the parameter Configuration)
66+
5767
.PARAMETER SqlInstance
5868
The target SQL Server instance or instances.
5969
@@ -63,7 +73,7 @@ function New-DbaFirewallRule {
6373
.PARAMETER Type
6474
Specifies which firewall rule types to create for SQL Server network access.
6575
Use this when you need to create specific rules instead of the automatic detection behavior.
66-
Valid values are Engine (SQL Server instance), Browser (SQL Server Browser service), and DAC (Dedicated Admin Connection). When omitted, the function automatically creates Engine rules plus Browser rules for non-default ports and DAC rules when remote DAC is enabled.
76+
Valid values are Engine (SQL Server instance), Browser (SQL Server Browser service), DAC (Dedicated Admin Connection) and DatabaseMirroring (database mirroring or Availability Groups). When omitted, the function automatically creates Engine rules plus Browser rules for non-default ports and DAC rules when remote DAC is enabled.
6777
6878
.PARAMETER Configuration
6979
Provides custom settings to override the default firewall rule configuration when calling New-NetFirewallRule.
@@ -113,13 +123,23 @@ function New-DbaFirewallRule {
113123
114124
Creates or recreates the firewall rule for the instance TEST on SRV1. Does not prompt for confirmation.
115125
126+
.EXAMPLE
127+
PS C:\> New-DbaFirewallRule -SqlInstance SQL01 -Type DatabaseMirroring
128+
129+
Creates the firewall rule for database mirroring or Availability Groups on the default instance on SQL01 using the default port 5022.
130+
131+
.EXAMPLE
132+
PS C:\> New-DbaFirewallRule -SqlInstance SQL02 -Type DatabaseMirroring -Configuration @{ LocalPort = '5023' }
133+
134+
Creates the firewall rule for database mirroring or Availability Groups on the default instance on SQL02 using the custom port 5023.
135+
116136
#>
117137
[CmdletBinding(SupportsShouldProcess, ConfirmImpact = "High")]
118138
param (
119139
[parameter(Mandatory, ValueFromPipeline)]
120140
[DbaInstanceParameter[]]$SqlInstance,
121141
[PSCredential]$Credential,
122-
[ValidateSet('Engine', 'Browser', 'DAC')]
142+
[ValidateSet('Engine', 'Browser', 'DAC', 'DatabaseMirroring')]
123143
[string[]]$Type,
124144
[hashtable]$Configuration,
125145
[switch]$Force,
@@ -328,6 +348,35 @@ function New-DbaFirewallRule {
328348
}
329349
}
330350

351+
# Create rule for database mirroring or Availability Groups
352+
if ('DatabaseMirroring' -in $PSBoundParameters.Type) {
353+
# Apply the defaults
354+
$rule = @{
355+
Type = 'DatabaseMirroring'
356+
InstanceName = $instance.InstanceName
357+
Config = @{
358+
Group = 'SQL Server'
359+
Enabled = 'True'
360+
Direction = 'Inbound'
361+
Protocol = 'TCP'
362+
LocalPort = '5022'
363+
}
364+
}
365+
366+
# Test for default or named instance
367+
if ($instance.InstanceName -eq 'MSSQLSERVER') {
368+
$rule.Config.DisplayName = 'SQL Server default instance (DatabaseMirroring)'
369+
$rule.Config.Name = 'SQL Server default instance (DatabaseMirroring)'
370+
$rule.SqlInstance = $instance.ComputerName
371+
} else {
372+
$rule.Config.DisplayName = "SQL Server instance $($instance.InstanceName) (DatabaseMirroring)"
373+
$rule.Config.Name = "SQL Server instance $($instance.InstanceName) (DatabaseMirroring)"
374+
$rule.SqlInstance = $instance.ComputerName + '\' + $instance.InstanceName
375+
}
376+
377+
$rules += $rule
378+
}
379+
331380
foreach ($rule in $rules) {
332381
# Apply the given configuration
333382
if ($Configuration) {

‎public/Remove-DbaFirewallRule.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ function Remove-DbaFirewallRule {
2121
.PARAMETER Type
2222
Specifies which types of SQL Server firewall rules to remove from the target computer.
2323
Use this to control exactly which network access rules are cleaned up when decommissioning or reconfiguring SQL Server instances.
24-
Engine removes rules for SQL Server database connections, Browser removes UDP port 1434 rules for SQL Server Browser service, DAC removes Dedicated Admin Connection rules, and AllInstance removes all SQL Server-related rules. Defaults to Engine and DAC since Browser rules are often shared between multiple instances.
24+
Engine removes rules for SQL Server database connections, Browser removes UDP port 1434 rules for SQL Server Browser service, DAC removes Dedicated Admin Connection rules, DatabaseMirroring removes database mirroring or Availability Groups rules, and AllInstance removes all SQL Server-related rules. Defaults to Engine and DAC since Browser rules are often shared between multiple instances.
2525
2626
.PARAMETER InputObject
2727
Accepts firewall rule objects from Get-DbaFirewallRule for pipeline-based removal operations.
@@ -77,7 +77,7 @@ function Remove-DbaFirewallRule {
7777
[Parameter(ParameterSetName = 'NonPipeline')]
7878
[PSCredential]$Credential,
7979
[Parameter(ParameterSetName = 'NonPipeline')]
80-
[ValidateSet('Engine', 'Browser', 'DAC', 'AllInstance')]
80+
[ValidateSet('Engine', 'Browser', 'DAC', 'DatabaseMirroring', 'AllInstance')]
8181
[string[]]$Type = @('Engine', 'DAC'),
8282
[parameter(ValueFromPipeline, ParameterSetName = 'Pipeline', Mandatory = $true)]
8383
[object[]]$InputObject,

0 commit comments

Comments
 (0)