Quick answer
QuickBooks firewall ports are the network rules that let the company-file database travel between the host computer and each workstation. QuickBooks Desktop needs TCP 8019 plus a dynamic port assigned during installation, and Database Server Manager shows that port on its Port Monitor tab. Allow the QuickBooks programs and both ports inbound and outbound on the server, create matching rules on the workstations, then test from a workstation. Never leave the firewall turned off.
What the firewall actually has to allow
In multi-user mode, workstations do not open the .QBW file directly. They read the .ND file next to it, which contains the host's IP address and port, then open a TCP connection to the database service on the host. A firewall that blocks either the database service or that port stops the connection and produces the message "Error: Cannot communicate with the company file due to a firewall," or a multi-user error such as H202.
Three layers can block that connection: Windows Defender Firewall, a third-party firewall, and the network protection inside an antivirus suite. Fixing only Defender is the most common incomplete repair, because endpoint security products filter the same traffic independently.
| Where | Direction | What to allow |
|---|---|---|
| Host / server computer | Inbound | TCP 8019 and the dynamic database port, plus the QuickBooks programs |
| Host / server computer | Outbound | Same ports and programs, for return traffic and updates |
| Each workstation | Outbound | QuickBooks programs and the same ports when the local firewall filters by application |
The ports QuickBooks Desktop uses
Every version uses TCP port 8019 for the QuickBooks application. Older versions added a fixed set of database ports; 2019 and later use a single dynamic port assigned at installation so each version gets exclusive use of one number.
| QuickBooks Desktop version | Ports to allow (TCP) |
|---|---|
| 2017 | 8019, 56727, 55373-55377 |
| 2018 | 8019, 56728, 55378-55382 |
| 2019 and later | 8019 plus the dynamic port shown in Port Monitor |
The dynamic port can change if someone selects Renew in Database Server Manager, or when a version is reinstalled. After renewing the port, run Scan Now on the Scan Folders tab to reset the firewall permissions, then update your firewall rules to the new number. Older versions cannot renew their ports.
Which programs to allow through the firewall
Port rules alone are not enough when a firewall filters by application. Create allow rules for the executables QuickBooks uses for data, backup, messaging and updates. Add them from the correct folder for your year.
| Program | Folder | Why it matters |
|---|---|---|
QBW32.exe | C:\Program Files\Intuit\QUICKBOOKS YEAR | The main QuickBooks application |
QBDBMgrN.exe | C:\Program Files\Intuit\QUICKBOOKS YEAR | The database manager process |
DBManagerExe.exe | C:\Program Files\Intuit\QUICKBOOKS YEAR | Runs Database Server Manager |
QBServerUtilityMgr.exe | C:\Program Files\Common Files\Intuit\QuickBooks | Server utility for shared access |
QBCFMonitorService.exe | C:\Program Files\Common Files\Intuit\QuickBooks | Company-file monitoring service |
QBUpdate.exe | C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate | Downloads QuickBooks updates |
Intuit's firewall article lists additional executables — including AutoBackupExe.exe, FileManagement.exe, FileMovementExe.exe, QuickBooksMessaging.exe, QBLaunch.exe, Dbmlsync.exe, IntuitSyncManager.exe and OnlineBackup.exe — with their exact folders. Add the full list on the server if you see intermittent failures on specific tasks, not just on opening the file. If a path shows Program Files (x86), the machine is 64-bit; that is normal.
Do not disable the firewall as a test. Turning off Windows Defender Firewall or your antivirus proves nothing you cannot prove with a scoped rule, and leaves the server exposed for as long as you forget to re-enable it. A correct rule allows only the QuickBooks programs and the two ports, only on the local network.
How to open QuickBooks ports in Windows Defender Firewall
Close QuickBooks and review the existing rules
Close QuickBooks on the computer where you are working. Open Windows Defender Firewall with Advanced Security and check Inbound Rules and Outbound Rules for entries already named for QuickBooks. If old rules exist for a version you no longer use, disable them so you do not keep opening ports for software that is gone.
Find the current database port
Open QuickBooks Database Server Manager from the Start menu and select the Port Monitor tab. Find your QuickBooks version and note the Port Number — that is the dynamic port you need for the rule, alongside 8019.
Press F2 inside QuickBooks on the host to open Product Information and confirm which computer is hosting: Local Server Information should read hosting local files only. That tells you the machine the inbound rule belongs on, while Port Monitor gives you the number to type.
Create the inbound port rule
In Windows Defender Firewall with Advanced Security, right-click Inbound Rules and select New Rule. Choose Port, then TCP, and in Specific local ports enter 8019,XXXXXXXX with the XXXXXXXXX replaced by the dynamic port you noted. Select Allow the connection, leave all profiles checked, and name the rule something like QBPorts(year) before selecting Finish.
Create the matching outbound rule
Repeat the same steps under Outbound Rules. Return traffic and shared services on the host need outbound access, and some third-party firewalls evaluate both directions. Keeping inbound and outbound rules named identically makes them easy to audit later.
Add program rules for the QuickBooks executables
Create another New Rule, choose Program, then This program path and browse to each executable in the table above. Select Allow the connection, check all profiles, and name the rule for the program, such as QBFirewallException(QBW32.exe). Repeat for each program and for the outbound direction. If you run more than one year of QuickBooks on the machine, do this for each year's folder.
Configure third-party firewalls and antivirus
For a third-party firewall or antivirus suite, add the same programs and ports using the vendor's documented method — not by turning protection off. Norton and McAfee both publish program-exception guides; check the vendor's current support site because menus change between releases. Also add the company-file folder and the QuickBooks program folder as exclusions for features named protected folders, ransomware protection or script blocking.
Rerun the Database Server Manager scan and restart
On the server, open Database Server Manager, go to Scan Folders, and select Start Scan. The scan repairs QuickBooks firewall permissions automatically and writes a fresh .qbw.nd file into the company-file folder. When it finishes, restart the computer so firewall changes commit, then reopen QuickBooks.
Test the connection from a workstation
On a workstation, open QuickBooks and open the company file over the network, then select File → Switch to Multi-user Mode. If it opens, the firewall rules are correct — test a second workstation at the same time before you call it done. If it still fails, see the multi-user setup guide for the hosting and sharing checks that firewall rules cannot fix.
Verification tests for firewall rules
- Press F2 on the server and confirm Local Server Information shows hosting local files only.
- Confirm the company-file folder contains a recent
.qbw.ndfile. No.NDfile means the scan has not completed successfully. - Open the company file from one workstation and switch to multi-user mode, then repeat from a second workstation at the same time.
- From a workstation, ping the server by name and by IP address. Both should reply with no packet loss; a name that fails while the IP succeeds points at name resolution, not the firewall.
- In PowerShell on a workstation, run
Test-NetConnection -ComputerName SERVERNAME -Port 8019and repeat with the dynamic port from Port Monitor. ATcpTestSucceeded : Trueresult confirms the rules are working. - On the server, run
netstat -ano | findstr :8019and check that a process is listening. For deeper network checks, run the Network Diagnostic tool from the QuickBooks Tool Hub.
What not to do with QuickBooks and your firewall
- Do not disable Windows Defender Firewall permanently. Use a scoped rule instead; if you disabled it while testing, turn it back on in the same session.
- Do not create allow-any rules. Opening all ports for all programs defeats the firewall and hides the real cause.
- Do not forward port 8019 through your router. Multi-user mode is for a trusted local network; the database was never designed to be exposed to the internet.
- Do not disable antivirus network protection as a permanent fix. Add program and folder exclusions instead, and revisit them after each version upgrade.
- Do not leave workstations opening inbound ports they do not host. Inbound 8019 belongs on the host only.
- Do not store the company file on a NAS. Database Server Manager does not support NAS devices, so firewall work will not fix that setup.
If multi-user access still fails after the rules
Firewall rules fix blocked connections, not misconfiguration. Check that only the server hosts multi-user access, that every workstation is in the same Windows network profile, and that the server's IP address has not changed since the scan. Rename the .ND file, rerun the scan, and try again. If you see an H-series code, work through the Error H202 and H505 fixes; if the file opens locally but never over the network, start with can't connect to the server troubleshooting.
Frequently asked questions
Which port does QuickBooks Desktop actually use?
QuickBooks uses TCP 8019 for the application, plus the database port for your version. QuickBooks 2019 and later use a dynamic port assigned at installation and listed on the Port Monitor tab of Database Server Manager; QuickBooks 2018 and 2017 used fixed extra ports instead.
Do I need to open ports on the workstations too?
The host needs inbound and outbound rules for the two ports. Workstations need outbound access to the host, and if their local firewall filters by application, add the QuickBooks programs there as well. In a simple network where Windows Firewall allows outbound traffic by default, the server rules do the heavy lifting.
Why did my QuickBooks port number change?
The dynamic port changes when someone selects Renew in Database Server Manager, when QuickBooks is reinstalled, or after certain version updates. Check Port Monitor, update the firewall rule to the new number, and run Scan Now on the Scan Folders tab to reset the associated firewall permissions.
Is it safe to open port 8019?
On a private local network, yes. The rule should allow only the local subnet and only while the host is serving QuickBooks. Do not forward the port from your router to the internet and do not allow it from public Wi-Fi or untrusted networks, because the database service is not designed to face the internet.