How do you move beyond all-or-nothing OPC connectivity to grant granular, user-specific access to plant data without relying solely on your OPC server’s built-in (often nonexistent) controls? An OPC security gateway fills that gap by acting as a configurable security layer between OPC servers and clients, enforcing encryption standards, certificate trust, and access control at the folder and item level.
Chapters
Webcast Summery
Most OPC servers ship with no read/write restrictions and no access control list — users either get everything or nothing, and encryption alone does nothing to limit what an authenticated client can see. Integrators routinely leave OPC UA connections set to “None” and OPC Classic open to all, while end users remain unaware of the exposure. An OPC security gateway inserts a hardened intermediary that closes these gaps without requiring changes to the underlying servers.
Key capabilities of the OPC Expert Security Gateway viewer and configuration interface:
- Endpoint restriction — Disable insecure or weak encryption profiles (e.g., “None” or 128-bit) directly from the server UI, leaving only Sign and Encrypt connections visible to clients.
- Certificate-based trust management — View incoming client certificates by computer and application name, then individually trust or reject each one; set new certificates to auto-reject until manually approved.
- OPC-native user accounts — Create usernames and passwords independent of Windows or Active Directory credentials, scoped directly within OPC Expert.
- Folder-level access control — Apply per-user permissions to specific branches of the OPC namespace, hiding entire servers or sub-folders from unauthorized accounts.
- Item-level access control — Restrict visibility down to individual tags, so different users see only the specific data points they are authorized to access.
- Multi-layer security stacking — Combine encryption policy, certificate trust, and username/password requirements in any combination, including requiring all three simultaneously for a single connection.
The OPC Expert Security Gateway moves OPC security from binary on/off to surgical, user-aware control — without touching a single OPC server configuration.
Hello everyone, and welcome to this live presentation titled “OPC Security Gateway,” where we explain how to apply security using a standards-based OPC security gateway. My name is Randy and I am the presenter today.
We’re going to be talking about the problem we’re trying to solve. Then we’ll talk about the security challenge we have in OPC and in automation. We will talk about what an OPC security gateway is, then I’ll show you the OPC Expert security gateway very specifically. I will also show you the architecture and give a little security example with a demonstration.
At the very end, I’ll let you know how you can get this webinar recording. We’ll also send you an email that includes some videos on how to set this up, as well as an invitation to the next webinar, which is about OPC UA alarms and conditions.
The Problem We’re Trying to Solve
OPC Classic servers have a lot of plant automation data — a huge amount of data — and we can access this data, but we need security. Firewalls are put up and they provide some security. By “some security” I mean that they do limit the ports, so they are already limiting the number of incoming connection points, which is very good. Some of them even do deep packet inspection, which goes even further to ask “what’s actually going on on this port?” But once you’re able to connect, you will be able to get everything.
So the question is: how do we add OPC security very specifically? For example:
- You need to be able to turn the entire connection on or off. Most OPC servers can do that. The difficulty most have is providing partial information.
- How do I trust some but not all of the users?
- How do I trust some but not all of the applications?
- How do I trust some but not all of the computers or devices connecting to me?
- How do I create my own OPC username and password — not a Windows username and password, but one that I create myself in OPC?
- How do I allow reading but not writing?
- How do I allow access to some but not all of the folders?
- How do I allow access to some but not all of the items?
- How do I turn on encryption — make it not just “none” but make it more secure?
There are a whole bunch of other things we can do, but these are just some examples of what we’re trying to solve.
The Solution
The solution looks like this. We have a couple of controllers and we can bring in the data via OPC and send it to the client application. The very first thing we’re going to do is set up the communication so you can get all of the data. The second thing we will do is block communication, so you’ll get some but not all of the data — and we will do it based on the specific user who is connecting.
Now, what prevents this client from connecting to these OPC servers directly? Sometimes you don’t want that because it will bypass the gateway. So as a first step you want to put on a firewall that blocks access to these servers and only provides access to the gateway. Then all communication will be coming just from this gateway.
The Security Challenge
The security challenge we have when trying to get information from our server to the actual client is this: the typical OPC server vendor provides no read/write restrictions and no access control list — no definition of who’s allowed to do what to whom. In other words, you either have complete communication or no communication, and only connection security is available. You’re encrypted or you’re not. Many people think, “If it’s encrypted, it’s secure.” No. Just because it’s encrypted doesn’t mean you don’t have access to all of the data inside. It just means that whoever is listening doesn’t understand what you’re saying. But the application can still get at anything in the server. So the typical vendors don’t provide the tools to manage security.
The typical integrator also receives only on-the-job training — which means every server is going to be different. Having a general security gateway makes things much, much easier for integrators. Integrators typically set OPC UA connections to “none,” meaning there is no security and no clue who’s coming in. With OPC Classic, they set connections open to everyone. Not particularly secure, but that’s what the typical integrator does.
And to add to the problem, the typical user doesn’t audit their systems to see what holes are left — they’re usually very unaware of security deficiencies. They’re not aware that communication is available to everyone. They don’t know where you can write to or read from. So they put their heads in the sand and everything keeps going until there’s a problem. This is what’s causing the big challenge in OPC, and why we need to put security in.
What Is an OPC Security Gateway?
Let’s talk about a security gateway — a general security gateway. In previous webinars we talked about OPC to MQTT, OPC to Excel, tunneling, and so on. Those were all middleware — you have OPC and you’re going somewhere else. In this case, we’re talking about the security gateway as a barrier. This is where we get our security from.
This needs to be very configurable and easy to learn. The whole idea is that it fills the security gaps. Whatever your OPC server doesn’t have, this is supposed to fill it. If your OPC server already has all of the security you need, then there’s no need for the gateway.
OPC Expert Security Gateway
Let’s take a look at what’s happening very specifically with the OPC Expert Security Gateway.
The security gateway runs on Windows XP all the way to Windows 11, and Windows Server 2003 all the way to Windows Server 2025 — from very early to the latest. There’s also support for OPC UA and OPC Classic, so no matter whether your server is OPC UA or OPC Classic OPC DA, it doesn’t matter — this one brings all that data across.
It runs as a Windows service, which means it’s always running as soon as Windows starts — it starts immediately and automatically, with no log-on required. It’ll start up automatically with Windows, which is typically what we want in automation.
It enables you to manage the OPC server encryption and the access control list. With the access control list I can say who is allowed to do what to whom. User One is able to read this, User Two is able to read that — they may have some things in common or they may not.
From a firewall perspective, you only need to open up one port — one port if you’re using UA, one port if you’re using HTTP, or one port if you’re using HTTPS. You can use any of these, but you really only need one port.
OPC Expert Module Architecture
Let’s have a look at what’s going on inside OPC Expert. These are the modules inside OPC Expert — when you get OPC Expert, you get all of these modules.
We begin with an OPC DA Client and OPC UA Client. OPC Expert ingests and brings in data via OPC DA, OPC Classic, or OPC UA. Once the data is there, we can send it out with OPC DA or OPC UA. This means OPC Expert is already a converter — baked into the architecture. You can take in OPC DA and send out OPC UA, or take in OPC UA and send out OPC DA. You can also connect to OPC UA and apply security — for example, only give a subset of what is available in the UA server, which is really what we’re trying to do with the security gateway.
In addition to those four basic modules, OPC Expert also includes:
- A built-in web server, so web clients can connect from a phone, tablet, or remote system.
- Built-in MQTT with a broker, publisher, and subscriber — a complete pub/sub system. You can bring in MQTT and send out OPC UA, or publish MQTT and bring it in with OPC UA or DA.
- SQL connectors — MySQL, Microsoft SQL, or whatever SQL you want.
- Cloud connectors — Amazon Web Services, Microsoft Azure, or file-based storage.
- OPC UA, OPC Classic HDA, and OPC Alarms and Conditions — bring all that information in and send it out as well.
- Excel integration — bring all of this information into Excel for a real-time view.
All of these modules are included with OPC Expert. When you download it, you get all of them — it’s just a question of which ones you want to use. In this webinar, we’re focusing on just the four OPC client and server modules.
Demonstration
Now let’s take a look at the demonstration. We have a couple of controllers. We’re bringing in data to OPC Expert via OPC servers — an OPC DA server and an OPC UA server — and we’ll see how this data comes into a client application.
The first step: we’ll set up the communication and see how we can get all of the data with no restrictions. Then we’ll put on security and begin to block communication. I’m not suggesting a preferred strategy — sometimes you want to reject everything and trust by exception, sometimes you want to trust everything and reject by exception. I just chose this particular strategy because it’s a little easier to demonstrate.
Starting OPC Expert
We have a server and a client. The first thing is to start up OPC Expert on the client. When you open the file location, you see just one executable. When you double-click it, you don’t need an installation — it automatically extracts all the files it needs and just runs. No installation needed.
We’ll do the same thing on the server side. OPC Expert will start on the server side as well. We also have UA Expert here, which is another OPC client, and we’ll run that as well — so we’ll have two different clients connected.
On the server computer I’ve got two OPC servers: the Iconics OPC server, which is a DA server, and the OPC Expert server, which is a UA server. There’s also the KEPServer, which is also a UA server.
Connecting to the OPC Expert UA Server
The first thing is to connect to the OPC Expert server. First I’ll make it run as a service — right-click, choose “Service,” and set it to run as the local system account. Now you can see the OPC Expert UA Server running as a service.
Now let’s connect to it. The IP address is 192.168.1.103. We can open up the computer and see we’ve got a DA server, the KEPServer, and the OPC Expert server. When I expand it, I can see my two servers inside: the Iconics server and the KEPServer. I haven’t put any security on yet — I can open them up, see everything inside them, and subscribe to items.
Connecting UA Expert
Now I’ll go to UA Expert as well and add a server: OPC TCP 192.168.1.103, port 57888. There we go — it’s finding the server. You can see there are a bunch of connection endpoints available. There is the red “None,” which is not secure, and a whole bunch of other connection mechanisms.
Applying Security — Step by Step
Step 1 — Restrict Encryption Endpoints
The first thing I want to do is clean up the available endpoints. I’m interested in security, so I don’t want to provide “None.” I also don’t want to provide 128-bit — it’s just not secure enough. Back on the server, I right-click, go to Security, and see everything I am exposing.
I’ll remove the 128-bit options, the “Sign only” options, and “None.” Now we only have three endpoints available — all “Sign and Encrypt.” After rebrowsing, you can see we now only see those three connection points, and all unencrypted or weakly encrypted options are gone.
Step 2 — Certificate Trust
Next, I’ll go to Security and move on to certificates. You can see there’s OPC Expert and UA Expert coming in from the Client PC. I’m going to reject both certificates and also set the server to reject new certificates by default.
As soon as that’s done, you can see the connections are reset. Both OPC Expert and UA Expert are constantly failing to get data — because they are rejected.
But watch what happens as soon as I trust those certificates. I’ll go to Security, go to OPC Expert, and click Trust. UA Expert is still rejected, but OPC Expert is now trusted and it’s able to get a connection and receive data. The other client can’t — only because I didn’t trust its certificate.
I’ll trust that certificate as well. Going forward, any new certificate that comes in will be immediately rejected — I’ll have to go in and trust them manually. This is a way to stop new connections from unknown sources.
Step 3 — User Account Restrictions (Access Control List)
The next thing I want to do is start giving some restrictions. Right now when I browse, I can see Logical, Numeric, Tanks, KEPServer, and everything inside — because most OPC servers will just give everything. You either give everything or nothing. So now let’s provide partial information.
I’ll go to the Numeric branch, right-click, and select Security. I’ll go to Users and Groups. Up until now I trusted by default, and both clients are coming in with no user account. Now I’ll set it to reject by default.
I’ll add User One with a password of “1” and User Two with a password of “2.” Both User One and User Two will get access to the Numeric folder.
This breaks communication immediately — both clients are coming in as Anonymous. Once I configure OPC Expert to log in as User One with the correct password, it can connect. After rebrowsing, we now only see the Iconics server and specifically only the Numeric branch — not KEPServer, not anything else. That’s exactly what we gave access to.
Step 4 — Item-Level Restrictions
Now let’s take a look at what happens if I only want a few items. I’ll connect as User Two with a password of “2.” After connecting and browsing, we can see only the Iconics server and only the Numeric folder — just as we configured.
I’ll also set up access for the Factory/OPCTI path — giving both User One and User Two access to that. Then for the Random folder, I’ll go further and give access only to the Random One item, and only to User Two.
After rebrowsing with User One (OPC Expert), we can see Iconics with only Numeric, and inside KEPServer only Factory and only OPCTI — not Random, because that’s the only thing made available to User One.
But when we look at UA Expert connected as User Two: Iconics shows Numeric and everything. Inside KEPServer Factory, we can see OPCTI and also Random — but only that one specific item. Because that’s exactly what we gave access to.
Step 5 — Computer/Certificate Restriction
One more thing to show. If I connect from a different computer (localhost 57888) and try to connect, it will fail. Going to Security, we can see a new certificate has appeared — and it’s rejected. It’s coming from Server PC. So with the security, I can apply restrictions to a specific computer. Even if that person had the username and password, they’re coming from a different computer and they can’t connect.
I can restrict it however I want — require a username and password, or both a username/password and a certificate, or just a certificate. All of these combinations are available.
Summary
What we saw was that we started with complete access to everything. Then we applied security step by step. First, we restricted security — not allowing insecure communication. Then we moved to certificates. Then we added users. So right now a client has to have secure communication, with a certificate from a specific computer and from a specific application, and must provide a username and password. You can do any combination of these depending on your needs.
And that’s the end of the formal part of the presentation.
Resources and Next Steps
For automated troubleshooting, you can download OPC Rescue or OPC Expert — both are free to download and will help you troubleshoot and diagnose connection problems.
If you get OPC Expert, there are a whole bunch of things you can do. In this webinar we talked about the security gateway, but there are different webinars covering all of the available modules.
For hands-on learning, we invite you to our vendor-neutral Certified OPC Professional Training. You’ll attend a workshop and learn how to configure DCOM and OPC, how to troubleshoot OPC systems, the security, and OPC best practices. You get two computers — both are yours, a client and a server. You get communication working. Then we break it. You diagnose, you fix, and then we break it again. You diagnose, you fix. At the end you have a very good idea of exactly what to do, how to troubleshoot, and how to get your systems working.
These workshops are live — typically live remote classes with a live instructor, and they’re very interactive. No travel required. We offer public classes as well as private classes for your organization, and we can do these either remote or onsite. Check out the dates at opcti.com.
We’ll send you an email with a link to this webinar recording, a link to download OPC Expert, and some OPC Security Gateway examples — videos showing you how to do exactly what we demonstrated here. You’ll also get an invitation to our next webinar on OPC UA Alarms and Conditions.
If you have any questions, give us a phone call, send us an email, or visit the website.