# Minimum set of ports open for datashiled **URL:** \ **Category:** Analyst Support\ **Created:** [30 April 2020 18:20 UTC](https://datashield.discourse.group/t/minimum-set-of-ports-open-for-datashiled/205 "2020-04-30T18:20:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![HankCao](https://avatars.discourse-cdn.com/v4/letter/h/b782af/32.png) [@HankCao](https://datashield.discourse.group/u/HankCao)\ **Post date:** [30 April 2020 18:20 UTC](https://datashield.discourse.group/t/minimum-set-of-ports-open-for-datashiled/205/1 "2020-04-30T18:20:17Z")
Dear all, We were setting up the opal server (Datashiled 5) in our institute for data sharing. For security issue, the ports of the machine were only exposed for the use of opal server, and rest ports must be closed. Can I know what is minimum set of exposed ports that the opal need ? To my knowledge, only 8080 is used for connection (between server and client) during the analysis. So should we only keep 8080 open? Regards, Hank ---
**Author:** ![yannick](https://yyz2.discourse-cdn.com/free1/user_avatar/datashield.discourse.group/yannick/32/19_2.png) [@yannick](https://datashield.discourse.group/u/yannick)\ **Post date:** [1 May 2020 07:12 UTC](https://datashield.discourse.group/t/minimum-set-of-ports-open-for-datashiled/205/2 "2020-05-01T07:12:48Z")
Hi, 8080 is the default HTTP port to opal and it is not recommended to expose it to the outside world as it is not an encrypted connection. Opal uses also 8443 for HTTPS. But it is even better, and we do recommend this, to use a reverse proxy such as Apache or Nginx, it will provide extra security. See [Opal’s documentation about reverse proxy](http://opaldoc.obiba.org/en/latest/admin/configuration.html#reverse-proxy-configuration). With a reverse proxy, and a configuration that redirects connections to HTTP (80) to HTTPS (443), you only need to expose 80 and 443 ports (and probably 22 if you need to administrate the server using SSH). See also [Let’s Encrypt](https://letsencrypt.org/) for getting a (free) valid SSL certificate for your reverse proxy. Best Yannick ---
**Author:** ![HankCao](https://avatars.discourse-cdn.com/v4/letter/h/b782af/32.png) [@HankCao](https://datashield.discourse.group/u/HankCao)\ **Post date:** [4 May 2020 10:22 UTC](https://datashield.discourse.group/t/minimum-set-of-ports-open-for-datashiled/205/3 "2020-05-04T10:22:31Z")
Hi Yannick, Thanks for the reply. Could you specify why reverse proxy impeoved the security level? I mean if we redirect port 8080 to 80, we seem not change anything. Regards, Hank ---
**Author:** ![yannick](https://yyz2.discourse-cdn.com/free1/user_avatar/datashield.discourse.group/yannick/32/19_2.png) [@yannick](https://datashield.discourse.group/u/yannick)\ **Post date:** [4 May 2020 12:28 UTC](https://datashield.discourse.group/t/minimum-set-of-ports-open-for-datashiled/205/4 "2020-05-04T12:28:34Z")
Hi, With a reverse proxy you can control the SSL cipher suite and protocols (some of them have security breach sometime). Despite the internal web server of Opal (Jetty) is updated regularly, it is usually easier for sys admins to update these well maintained ones (Apache or Nginx). They also provide other convenient functionalities such as port redirection and integration with Let’s encrypt certificates. You can also redirect to multiple opal instances internally with the same reverse proxy. Yannick ---
**Author:** ![stefan.lenz](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@stefan.lenz](https://datashield.discourse.group/u/stefan.lenz)\ **Post date:** [6 May 2020 09:12 UTC](https://datashield.discourse.group/t/minimum-set-of-ports-open-for-datashiled/205/5 "2020-05-06T09:12:24Z")
@HankCao You should definitely not use port 80 or 8080 for a production server because this is normal HTTP. User passwords will be submitted without encryption and can be read by someone who listens on your connection. ---
**Author:** ![HankCao](https://avatars.discourse-cdn.com/v4/letter/h/b782af/32.png) [@HankCao](https://datashield.discourse.group/u/HankCao)\ **Post date:** [18 May 2020 09:27 UTC](https://datashield.discourse.group/t/minimum-set-of-ports-open-for-datashiled/205/6 "2020-05-18T09:27:14Z")
> [@stefan.lenz](#): > > production server because this is normal HTTP Thanks, we will block it. Hank