OPC Architecture: Firewalls, Dashboards, and Connector Options

OPC Architecture: Firewalls, Dashboards, and Connector Options

A reliable OPC architecture for industrial environments must move data from controllers and OPC servers to IT systems and dashboards while respecting the security boundaries between the operational technology (OT) network and the IT network. The recommended pattern involves keeping OPC Expert on the OT side of the primary firewall, using tunneling to pass data across network boundaries on a single port, and delivering data to SQL or cloud platforms that IT-managed visualization tools can query without direct access to the OPC layer.

Where OPC Expert Sits in the Architecture

OPC Expert is deployed on a computer with access to the OPC servers that expose your PLC and DCS data. This is typically a plant-floor workstation or a dedicated data collection server on the OT network. OPC Expert connects to OPC DA and OPC UA servers on that network using the native OPC protocol, collects data, and then transmits it across the network boundary to SQL, cloud platforms, or MQTT brokers using its built-in tunneling and secure transport options. This means OPC Expert acts as the bridge between the OT layer and the IT layer, and the firewall only needs to allow the single configured port used by OPC Expert’s outbound connection rather than the broader port ranges that raw DCOM-based OPC would require.

Firewall and Port Considerations

Traditional OPC DA communication over DCOM is notoriously difficult to manage through firewalls because it uses dynamically assigned ports. OPC Expert’s built-in tunneling resolves this by encapsulating OPC communication over a single, user-configurable port. When data needs to cross a firewall, you open that one port on the firewall for the outbound connection from OPC Expert to the remote SQL server or cloud endpoint. For OPC UA, the protocol itself uses a configurable port, and OPC Expert’s OPC UA client communicates through that port using the security mechanisms built into the OPC UA specification. The combination of OPC Expert tunneling for legacy OPC DA and native OPC UA port configuration covers both legacy and modern deployments without requiring a complex firewall rule set.

Dashboarding and Visualization Layer

The recommended approach to dashboarding is to separate the visualization layer from the OPC layer by routing archived data to SQL or a cloud platform and connecting dashboard tools to those data stores rather than directly to OPC servers. Tools such as Power BI, Grafana, Excel, or web-based custom dashboards connect to SQL or cloud databases using standard database connectors and are therefore maintained and managed entirely on the IT side without requiring OT-side access. OPC Expert’s built-in OPC Trend Software and REST API provide an additional visualization option for operational staff who need direct access to live and historical OPC data without going through the SQL layer, and these are accessible through a standard web browser on any device.

Redundancy and Resilience

For critical archiving paths, OPC Expert includes built-in redundancy that allows it to fail over to a secondary OPC server if the primary becomes unavailable. Combined with store-and-forward for the destination side, this means both the data source and the data destination can experience interruptions without resulting in gaps in the archive. Running OPC Expert as a Windows service ensures it restarts automatically after a reboot or unexpected shutdown, maintaining continuous operation without manual intervention.

Relevant Tools

Archive OPC Data from OPC Expert manages the data collection and SQL or cloud delivery, including tunneling and store-and-forward across network boundaries. OPC Tunneler from OPC Expert is available for environments that need a dedicated tunneling solution to replace DCOM-based OPC DA communication with a single-port, firewall-friendly alternative. OPC Security Gateway from OPC Expert adds granular access control and authentication enforcement for OPC connections, which is appropriate when multiple applications or users need controlled access to OPC data from across the network.

Conclusion

The recommended OPC architecture keeps the OPC layer on the OT network, uses OPC Expert as the data collection and forwarding agent, crosses network boundaries on a single configurable port, and delivers data to SQL or cloud destinations where IT-managed dashboard tools can consume it. This pattern respects the IT/OT security boundary, reduces firewall complexity, and gives both operations and IT teams access to the data they need through the tools they already use.