How OPCNet Broker® lets OPC clients in an industrial DMZ reach OPC servers in the OT network by opening one TCP port, instead of the multiple dynamic ports DCOM requires.
Industrial networks are segmented by firewalls to enforce security boundaries between OT (operational technology) systems, the industrial DMZ (demilitarized zone) and IT applications, in line with the Purdue model.
This use case shows how OPCNet Broker® DA HDA AE carries OPC (Open Platform Communications) Classic traffic across a firewall while the firewall continues to enforce the boundary between zones.
Direct OPC Classic communication across a firewall is difficult to configure. Microsoft DCOM (Distributed Component Object Model), which OPC Classic relies on between machines, uses a fixed port for its endpoint mapper and then negotiates additional ports dynamically, so firewall administrators must either open a wide port range or restrict DCOM to a fixed range through DCOM configuration on every machine involved.
Each of these options takes time to set up, is hard to review, and widens the attack surface between security zones that are meant to stay separated.
The site needed an approach that would:
OPCNet Broker® carries OPC communications through a tunnel that uses a single configurable TCP (Transmission Control Protocol) port.
The OPCNet Broker® Server Side runs next to the OPC server in the OT network, and the OPCNet Broker® Client Side runs next to the OPC client in the DMZ. The firewall administrator permits only the TCP port used by the tunnel, between the two approved hosts, instead of the ports required for direct DCOM communication.
OPC data flows through the encrypted tunnel, and the firewall keeps enforcing the network boundary for all other traffic.
Figure 1: OPCNet Broker® tunnel crossing a firewall between the OT network and the industrial DMZ
A central application hosted in the industrial DMZ, such as a historian or reporting tool, needs to retrieve data from an OPC server inside the plant OT network.
The OPCNet Broker® Client Side and Server Side communicate through a tunnel that crosses the firewall on one configured TCP port. No direct DCOM traffic is permitted between the two network segments.
The result is a simpler connectivity architecture that preserves the separation between the networks.
Open a single configured TCP port for the OPCNet Broker® tunnel.
No need to open multiple or dynamically negotiated ports for DCOM.
Firewall rules that are short, explicit and easy to review.
Connect OPC systems located in different network segments.
A tunnel alone does not make an OPC deployment secure. In production, enable encryption and user authentication on the OPCNet Broker® tunnel, restrict the configured TCP port to approved hosts, use application whitelisting, and harden the machines hosting OPCNet Broker® and the OPC applications. The full checklist is available in the use case "Sharing Custody Transfer Metering Data Between Organizations Without Connecting Their OT Networks".
Talk to an Integration Objects expert about your use case, or request a technical assessment of your OPC architecture.
OPC TunnelingHow OPCNet Broker® secures the OPC links between the OPC servers at each plant and a local data collection application, which forwards the data to a central historian or database, with encryption, authentication and tag-level access control.
OPC TunnelingHow OPCNet Broker replaces DCOM-based OPC Classic connections inside a single plant network with one encrypted tunnel, making OPC links simpler to deploy, secure and troubleshoot.
OPC TunnelingHow producers, pipeline operators and downstream operators exchange custody transfer metering data DMZ to DMZ with OPCNet Broker® and OPC Data Transfer, without connecting their process control networks.