Welcome to this presentation on OPC tunneling. My name is Randy, and I’ll be your presenter today. We’ll cover the problem definition — what are we trying to solve? — then explain the solution: what tunneling is and how it works. I’ll demonstrate tunnel connections, including a communication failure and its diagnosis, followed by a successful tunnel connection and a successful connection through a firewall. At the end, I’ll show you how to get a copy of this webinar recording and where to download the software.
OPC Classic and DCOM
OPC Classic uses DCOM, which is quite reliable and secure. I may be the first person you’ve heard say this, but DCOM is actually very good. It provides automatic reconnections, a message queue, built-in encryption, authentication, and authorization. It’s all in there if you know how to configure it. DCOM is also very stable and mature. COM has been around since 1993, and Distributed COM came out in 1996 — as of today, that’s 29 years old, which is several lifetimes in computing. There are tens of thousands of applications that use DCOM today, even outside the world of OPC.
The Challenges with OPC Classic
Everything I’ve described sounds great, so what’s the problem? Configuring DCOM can be confusing without proper training. We built a company around this — OPC Training Institute provides extensive training on OPC Classic, DCOM configuration, OPC through firewalls, and DCOM settings. We can show you how it all works, but without that training, it can be confusing.
There’s also the problem that many automation products don’t handle DCOM behavior elegantly. They may have poor timeout handling, vague communication-loss messages, or unhelpful error dialogs like “Couldn’t connect to OPC server. Call the system administrator.” When you are the system administrator and have no idea what to do, that message doesn’t help at all.
There’s also a lot of misinformation out there. For example, “you can’t connect 64-bit Windows to 32-bit Windows” — you can. Or “you can’t get workgroups and domains communicating” — you can, with OPC Classic.
Common OPC and DCOM Errors
A useful clue: if an error code starts with 0x80, it’s usually a DCOM error. Some of these errors prevent communication from starting at all, while others appear after OPC is already working and then stops. The same error code can mean different things depending on whether communication never started or failed mid-session, which makes interpretation difficult when applications don’t handle error context well.
When to Use OPC Tunneling
Our recommendation is to use pure DCOM whenever possible. Don’t add extra products or tunneling — just configure DCOM properly and you’ll have communication. Consider OPC tunneling only in the few cases where DCOM is genuinely not appropriate. If you’re not sure whether your situation is one of those cases, give us a call. This is what we do.
The bottom line is that OPC is a communication standard, but DCOM scares people. There are proprietary and non-proprietary APIs and protocols that serve as alternatives to DCOM. The idea behind a tunnel is that it works like a phone: your voice goes into your end and comes out the other side. You don’t need to understand how the network in between works. Once you understand how to use a phone, it doesn’t matter whether it’s a landline, a mobile, or a VoIP device. The same principle applies to a tunnel.
How OPC Tunneling Works
Without a tunnel, the setup is a PLC connected to two computers: an OPC server on one side and an OPC client on the other. The server connects to the PLC, then the server and client connect via OPC DA over DCOM.
With tunneling, the same physical arrangement applies, but instead of DCOM between the client and server, you install one half of the tunnel on the server side and the other half on the client side. The tunnel carries the communication using OPC UA on port 57888. The OPC client still makes a local OPC DA connection to its side of the tunnel, and the OPC server still makes a local OPC DA connection to its side. In other words, OPC DA goes in on both ends, and OPC UA handles the transport in the middle. How it works in the middle isn’t particularly important — what matters is that it’s OPC in and OPC out.
What’s Inside OPC Expert
OPC Expert contains an OPC UA client and a DA client to ingest data into its intelligent engine. Data exits via an OPC DA server or an OPC UA server. This means OPC Expert is, first and foremost, a converter between OPC DA and OPC UA in both directions.
But that’s not all. OPC Expert also includes an Excel RTD server so you can pull data directly into Excel — we have a separate webinar on that. It includes a complete MQTT pub/sub system with a broker, publisher, and subscriber, all with access to the internal data engine. You can also send data to a database such as Microsoft SQL, MySQL, or SQLite, or store data in a CSV file. OPC Expert handles all of this natively.
Additional data sources include OPC Alarms & Events, OPC HDA, a built-in API for custom applications, and a REST API server for publishing data to your network or the internet — again, we have a separate webinar covering REST API specifically.
Everything described above is contained within OPC Expert. In this webinar, we’re focusing on the tunneling modules specifically, but all of it ships in the same package.
OPC Expert Features
The tunneling in OPC Expert is entirely standards-based, using only one port and OPC UA security. OPC Expert can also apply its own security layer on top, allowing you to restrict access to specific data items. It includes automated recovery, built-in redundancy, and runs as a Windows service, so Windows can start and restart it automatically. It supports Windows XP through Windows 11 and Windows Server 2003 through Windows Server 2025, with the ability to connect to Windows NT and Windows 2000 as well.
OPC Expert also functions as a normalizer. If a server supports only limited OPC browse functionality, OPC Expert introduces additional browsing capabilities. If a client doesn’t subscribe correctly to a service, OPC Expert normalizes the conversation — in effect converting between versions of OPC DA. There’s a built-in debugger and log files that capture every call being made on both sides, so you can see exactly what’s happening.
As a converter, OPC Expert turns an OPC DA client into an OPC UA client, and turns an OPC DA server into an OPC UA server — all built in.
Live Demonstration
In the demonstration, we have two computers: Side A and Side B. OPC Expert is a single executable that you download and run. When you start it, it automatically extracts and sets up everything it needs.
On Side A, browsing for Side B initially fails. OPC Expert diagnoses the issue and explains that a user account or password change would resolve it — which is accurate, but since we’re here to look at tunneling, we’ll go that route instead.
On Side B, we start OPC Expert and import OPC servers. OPC Expert immediately discovers two servers on the other side: a KepWare server and a Modbus server. We select both and import them. Once imported, expanding the Modbus server shows live data coming from Side B. From Side A, the OPC server appears to be local — you can browse it exactly as you would a local server, but the data is actually coming from Side B.
Other OPC clients see the tunneled servers the same way — as local OPC servers. The only indication that a server is remote is in the description field, which shows it’s located on Side B. Using OPC Quick Client, a free OPC client from KEPWare, we can connect to the tunneled KepWare server, browse to the Factory I/O items, and confirm that data is coming in with good quality.
Failure and Recovery
To demonstrate failure handling, we kill the source OPC server on Side B while data is actively flowing in two clients on Side A. The tunnel immediately detects the communication failure, marks the data as out of service, and then recovers automatically once the server is available again. Quality returns to good without any manual intervention.
Running as a Windows Service
To run OPC Expert as a Windows service, right-click it, select Run as Service, and choose the local system account or a specific account as needed. OPC Expert sets itself up as a service, and the tunnel reconnects automatically during the brief setup period. Once complete, OPC Expert runs as a service under the system account with minimal CPU usage.
Firewall Test
With the tunnel running as a service, we enable the Windows firewall on Side B. In the inbound rules, there is one exception for Remote Desktop and one for OPC Expert — a single port: 57888. With the firewall on, the computer can no longer be pinged, yet data continues to flow through the tunnel without interruption. No Windows user account credentials are required on the connecting side. The tunnel operates cleanly through the firewall on a single port.
Troubleshooting Tools
You can download OPC Rescue for automated troubleshooting. OPC Expert also provides verbose diagnostic output — it identifies the reason a connection failed and suggests corrective steps. If you download OPC Expert, you’ll be able to trend, bridge, and tunnel, along with all the other capabilities included in the product.
Training and Certification
If you want more hands-on learning, consider joining one of our certified OPC professional training classes, where you can earn your Certified OPC Professional designation. Our hands-on workshops cover DCOM configuration, OPC Classic and OPC UA, troubleshooting OPC systems, applying security correctly — firewall configuration, user accounts, access control lists, and least-privilege practices. In class, you work with two computers, one acting as client and one as server. We break things and you fix them. It’s a surprisingly good time.
Classes are live and remote, with a live instructor. They’re public classes, meaning you attend alongside people from other companies. We can also run private training sessions for your organization, either onsite or remote. You can find upcoming dates at opcti.com.
Links and Next Steps
We’ll send you an email with a link to this webinar recording and a link to download OPC Expert — the same version demonstrated here — along with some OPC tunnel examples. If you’d like them right now, use the QR code or URL provided during the session. The email will also include an invitation to our next webinar, OPC to Excel, scheduled for October 2nd.
If you have any questions, send us an email or give us a call. We do answer the phone.
