How do you connect an OPC DA server on a corporate domain to an OPC client inside a DMZ that is not a domain member?
Why Connecting an OPC DA Server on a Domain to a DMZ Client
This scenario presents one of the more common and persistent challenges in industrial network architecture. OPC Classic DA relies on DCOM, and DCOM’s authentication model is built around Windows domain trust relationships. When the client machine is in a DMZ and is not a domain member, the domain controller is not available to broker authentication, and the standard DCOM connection mechanism fails.
Why Standard OPC DA Fails Across This Boundary
DCOM requires that both the server and client machines share a common authentication context. On a domain, this is handled automatically through Active Directory. When the client is outside the domain, there is no shared authentication context, and DCOM callbacks from the OPC server to the client are blocked. Even if the client can initiate the connection, the server cannot deliver asynchronous data updates back to the non-domain client, resulting in a connection that appears to succeed but produces no data.
Using OPC Expert’s Tunneler to Cross the Boundary
OPC Expert’s OPC Tunneler is designed precisely for this type of network boundary problem. The Tunneler runs on the domain-joined machine where the OPC DA server resides, and it exposes the OPC data through OPC UA or a TCP-based transport on a single configurable port. The DMZ client connects to this port using OPC UA or the OPC Expert client, bypassing DCOM entirely. Because the transport is TCP-based, the firewall between the domain and the DMZ only needs to permit traffic on that one port.
Authentication in This Configuration
The Tunneler supports Windows authentication and OPC UA certificate-based security, so the communication across the boundary is authenticated and can be encrypted. On the server side, the Tunneler runs as a Windows service within the domain, so it has the domain credentials needed to communicate with the OPC DA server locally. The DMZ client then authenticates to the Tunneler using credentials or certificates configured within OPC Expert, rather than attempting domain authentication directly.
Relevant Tools
OPC Expert (OPC Tunneler): Eliminates the DCOM dependency by wrapping OPC DA communication in a standard TCP or OPC UA transport, enabling cross-boundary connectivity without domain membership on the client side.
OPC Expert (Troubleshooting OPC and DCOM): Helps identify whether connection failures to embedded servers are caused by DCOM settings, network restrictions, or authentication requirements at each stage of setup.
When a domain boundary separates an OPC DA server from a non-domain client in a DMZ, the Tunneler provides the correct architectural solution by removing the DCOM layer from the cross-network path entirely.