UFW, Ports and Firewall Configuration

Firewalls may be already configured by your IT team, especially if running XNAT within a VM. However, if not, the firewall of the server must be set. Linux uses iptables to configure the firewall. UFW is a tool to make configuring iptables a lot easier, with simple commands. By default, all ports are closed by UFW.

The relevant default ports for XNAT are:

http - port 80
https - port 443
ssh - port 22
DICOM protocol - ports 104

If you are running XNAT inside a Docker container, install ufw on the host computer.

ubuntu/debian: sudo apt-get install ufw
redhat/centos: sudo yum install ufw

IMPORTANT - if you are connecting to your server by ssh, you MUST allow port 22 (ssh) before enabling UFW.

ufw allow ssh
ufw allow https
(optional) ufw allow 8104
(optional) ufw allow 104

You may wish to limit access by ip address range (recommnded!). Replace the above with, for example:

sudo ufw allow from 15.15.15.0/24 to any port 22

replacing the ip address with your ip address or range.

The docker service acts partially as a firewall for the container. The default DICOM transmission port is 104. However, this is a privildged port, and as the default XNAT receiver is on port 8104 (non-priveldged) you can redirect port 104 to port 8104 - so data sent from PACS on port 104 is received on port 8104.

The docker-compose-stack contains sections:

       ports:
        - "8104:8104"

To recive DICOM on port 104, you can change it to:

       ports:
        - "104:8104"

DICOM images sent via port 104 from PACS will be redirected to port 8104 inside the Docker container.

You can add or remap ports to an existing XNAT. When you build XNAT a copy of the docker-compose-stack.yml file is made and renamed docker-compose.yml. You can make changes to this new file on an existing XNAT and restart XNAT as per the maintenance page.

For example, you may want to open port 105 to reciver DICOM data via another DICOM receiver - for example, to receiver data requested using the DQR plugin. For this you'd need to open port 105 on the host server and add to docker-compose.yml

       ports:
        - "104:8104"
        - "105:8105"

Next step: Install XNAT