We have Team Foundation Server 2010 environment is in place. Which is working fine. We want to open the TFS Web access to internet.

We want to follow the link- http://qa.social.msdn.microsoft.com/Forums/en-US/tfssetup/thread/6bac41e0-6600-4ef2-8006-7095fcf3d84b.

We are testing it on our test environment. The additional apptier is in the DMZ zone. But the data tier is well with in our domain. What are the port we need to open to achieve this.

Situation is very urgent, my job is in the line.

Could anybody please help.



Hi pipTheGeek, Thanks for your response and pointers. I will tell you what we have so far step by step.

  1. We were provided with a server in DMZ, where port 80/443 was opened from internet to DMZ. This server has public IP assigned to it by Network team. 2.This DMZ server had port 8080/1433/9191 opened from DMZ to Apptier in intranet.
  2. We tried installing/configuring additional apptier on the server, configuration failed. We think that it happened because 1433 is not open from intranet datatier to DMZ.
  3. After encountering this failure, we added DMZ server in our domain where our original TFS setup is also there.
  4. We logged in to DMZ server with our Domain Admin credentials.
  5. Configuration happened successfully. We were able to access the TFS WEB inside the DMZ server. 7.In DMZ server we did port forwarding for port 80 to 8080 using NETSH INTERFACE PORTPROXY .
  6. Now with using public IP of DMZ appended with /tfs/web, we are able to access the TFS WEB from internet. It asks for domain credentials for authentication. We can see Work Items and Source Control only.

Please let us know how far we have reached and what else do you recommend.Any thing else you want add please let us know.

Once again thanks for your help.

Kind Regards.


TFS can be accessed over port 8080.

You need to open up this port in your firewall, and forward traffic to the TFS server; a nice drawing is available here: http://msdn.microsoft.com/en-us/library/ms252473.aspx


Use the new hosted service? Its free!


  • Do you have a link ? – adaptr Apr 20 '12 at 14:03
  • For some reason it didn't display first message. Good luck! – Tim Elhajj Apr 20 '12 at 14:05

The document you linked to was for exposing just the Team System Web Access on the internet, not full TFS functionality. Although, I believe both the team system web access and TFS itself use port 8080 by default. So you need port 8080 open from the internet to the app tier, then you need to allos the app tier to communicate with SQL Server. SQL Server by default uses port 1433, but if this is a named instance of SQL it won't be using that port.

The thread you linked to suggested a second app tier because they wanted to expose only a small amount of the functionality to the internet. If you are exposing the core TFS web service then I don't think a second app tier is necessary, not from the security side anyway, I don't know if your situation means it might be necessary for performance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.