Network Ports
Which ports the OPC Router uses depends on the installation type and the configured plug-ins. This page lists them with their default values so that you can selectively open only the ports you actually need in your firewall.
You should only open ports that need to be accessible from the outside. A port whose plug-in is not configured is not needed. In Docker mode, a port must also be published to the host using -p—without this publication, it is not accessible from the outside anyway.
The “Context” column indicates where the port is located: in the container installation, in the Windows installation, or in both.
Incoming Connections
| Port | Purpose | Context |
|---|---|---|
8080 / 8443 | Web management via HTTP or HTTPS. Default values from OR_WEB_HTTP_PORT and OR_WEB_HTTPS_PORT; see Configurable environment variables . 8080 is the only port that a container must always expose. | Container |
5000 / 5001 | Web management via HTTP or HTTPS. The Windows setup configures these ports during installation; if one of them is in use, it searches for the next available port. | Windows |
27017 | Internal MongoDB. It is bound to 127.0.0.1 and is not exposed externally by the runtime image; no port forwarding is required for operation. An external database at has its own port for connection instead. | both |
53200 | are runtime health endpoints; the default value is OR_RUNTIME_HEALTH_ENDPOINT_PORT. The port is only accessible via loopback, so port forwarding is neither necessary nor effective. From outside the network, you can query the same status via Web Management at /health/runtime/...; see Health endpoints . | both |
49954 | Standard port for status queries between two OPC routers in redundancy mode. , however, the primary system accesses secure redundancy via the port of its web management interface. | both |
49420 | Standard port of the OPC UA server for opc.tcp. The port is configured per server instance; multiple instances each require their own port. | both |
61212 | Standard port of the HTTPS endpoint of the OPC UA server. The endpoint is disabled by default; without it, HTTPS access runs via the Web Management port; see OPC UA Server via HTTPS . | both |
3300 | Default port of the IDoc trigger for IDocs that the SAP® system sends to the OPC Router. | both |
| configurable | REST server . The plug-in does not have a default port; the port is specified for each plug-in instance. If the API is also exposed via the Web Management endpoint, no separate exposure is required. | both |
Outgoing connections
For outbound connections, the OPC Router connects to the port of the respective target system—database, OPC server, mail server, or cloud service. The address and port are specified in the configuration of the corresponding connection. Two default values are hard-coded into the product:
| Port | Purpose | Context |
|---|---|---|
502 | Default port for Charm and printer devices. The OPC Router establishes outbound connections to the port specified in the respective device connection; 502 is the default value there. | (outbound) |
143 | IMAP: Default port for retrieving emails via the email trigger . | (outbound) |
Regardless of the engineering configuration, the OPC Router communicates with fixed destinations on the Internet—licensing, pronubes connection, and the Solution Gallery. These are listed with their addresses, ports, and purposes at . Network requirements for firewalls and proxies can be found at .
Firewall
The Windows setup does not configure any firewall exceptions. During installation, it merely points out that the firewall may prevent access to Web Management. Therefore, create the necessary rules yourself—one for each port listed in the table that you need to access from outside the network.
Disabling the firewall is not a substitute for this. For troubleshooting purposes, you may temporarily disable it to confirm or rule out a block as the cause; immediately re-enable it afterward and replace the test with the appropriate rule.
Ports Not Used by the OPC Router
8001– In older examples, this port representsdocker runanddocker compose. The OPC Router does not listen on this port; publishing or sharing it has no effect.135– This is not an OPC Router port, but rather the Windows RPC Endpoint Mapper. It is required when the OPC Router accesses an OPC server on another computer via OPC Classic: The client first queries the endpoint mapper there and negotiates the dynamic port for the actual connection with it. The necessary shares apply to the computer hosting the OPC server; see Distributed OPC Servers/DCOM .