Windows firewall exceptions for a domain trust

Question

If I have two disparate domains and I need to deploy a domain trust, do I need to create exceptions for the required network ports on each Windows server firewall for every domain controllers?

Answer 1

Hello jpcapone,

Thank you for posting in Q&A forum.

Yes, when you deploy a domain trust between two different domains, you usually need to open some specific network ports on the firewall of each domain controller to allow the necessary communication between the two domains. This is because domain trust involves authentication, authorization, and synchronization of directory service information, which requires the use of protocols such as Kerberos, LDAP, DNS, and others. Here are some common port requirements:

Kerberos Protocol:

TCP/UDP port 88 (Kerberos Key Distribution Center (KDC) service)

Lightweight Directory Access Protocol (LDAP):

TCP/UDP port 389 (LDAP)

TCP port 636 (LDAPS, if SSL encryption is used)

DNS Services:

UDP port 53 (DNS lookup)

TCP port 53 (for zone transfer or update)

SMB Ports:

445/TCP: SMB (for file sharing)

W32Time Port:

123/UDP: W32Time (for time synchronization)

In order to ensure that the domain trust is working properly and that there is valid communication between the two domains, an exception or allow rule should be created in the firewall rule for the above ports, and that the trust relationship between the two domains and the forest trust relationship are configured correctly and that the DNS resolution is correct.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

In general, you should - unless you know very well your AD environment and you can determine which domain controllers are communicating with each other. That, however, might change anyway due to a domain controller failure or an intermittent issue that alters that communication.

Details at https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts

---

hth
Marcin