Back to Checks
azure

Azure SQL Server does not have firewall rules allowing 0.0.0.0-255.255.255.255

sqlserver_unrestricted_inbound_access
Service: sqlserverSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:microsoft.sql/servers

Azure SQL Server server-level firewall rules are evaluated for an entry that allows the entire IPv4 space (0.0.0.0 to 255.255.255.255).

The finding identifies presence of this Internet-wide rule on the server firewall.

Prowler logoProwlerprowler-provider-azure

Risk

An Internet-wide rule permits unsolicited access from any host, enabling mass scanning, brute force, and exploitation of weak configurations.

  • Confidentiality: unauthorized data access/exfiltration
  • Integrity: malicious data/DDL changes
  • Availability: resource abuse or DoS via excessive connections

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks sqlserver_unrestricted_inbound_access

Recommendation

Remove the all-open rule and enforce least privilege.

  • Restrict access to specific IPs/ranges
  • Prefer private endpoints or VNet rules to avoid Internet exposure
  • Layer controls (NSGs, Azure Firewall)
  • Avoid broad exceptions like Allow Azure services and never use 0.0.0.0/0

Remediation

CLI

az sql server firewall-rule delete --resource-group <RESOURCE_GROUP> --server <SERVER_NAME> --name <RULE_NAME>

Terraform

# Replace any allow-all firewall rule with a restricted range
resource "azurerm_mssql_firewall_rule" "<example_resource_name>" {
  name             = "<example_resource_name>"
  server_id        = "<example_resource_id>"
  start_ip_address = "<START_IP>" # Critical: not 0.0.0.0
  end_ip_address   = "<END_IP>"   # Critical: not 255.255.255.255
}

NativeIaC

// Update the firewall rule to not allow the entire Internet
resource sqlServer 'Microsoft.Sql/servers@2021-11-01' existing = {
  name: '<example_resource_name>'
}

resource restricted 'Microsoft.Sql/servers/firewallRules@2021-11-01' = {
  name: '${sqlServer.name}/<example_resource_name>'
  properties: {
    startIpAddress: '<START_IP>' // Critical: not 0.0.0.0; restricts start IP
    endIpAddress: '<END_IP>'     // Critical: not 255.255.255.255; restricts end IP
  }
}

Other

1In the Azure portal, go to SQL servers and select your server
2Open Security > Networking
3Under Firewall rules, find any rule with Start IP 0.0.0.0 and End IP 255.255.255.255
4Select the rule and click Delete
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.sqlserver.sqlserver_client import sqlserver_client


class sqlserver_unrestricted_inbound_access(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, sql_servers in sqlserver_client.sql_servers.items():
            subscription_name = sqlserver_client.subscriptions.get(
                subscription, subscription
            )
            for sql_server in sql_servers:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=sql_server
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) does not have firewall rules allowing 0.0.0.0-255.255.255.255."
                for firewall_rule in sql_server.firewall_rules:
                    if (
                        firewall_rule.start_ip_address == "0.0.0.0"
                        and firewall_rule.end_ip_address == "255.255.255.255"
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has firewall rules allowing 0.0.0.0-255.255.255.255."
                        break

                findings.append(report)

        return findings

References