You guys forget that a lot of the connections to the SQL port are from a source port of 53. Since there are plenty of firewalls out there which don't do stateful UDP firewalling, the packet filter things the packet coming from port 53 is just an answer to a DNS request the SQL server sent to the internet.