Status code · Connection
BadConnectionRejected
BadPort / firewall
BadConnectionRejected means the client could not open a network connection at all: nothing is listening on that host and port, a firewall dropped or refused it, or the address does not resolve. Establish TCP reachability with nc or Test-NetConnection before touching endpoints, certificates or credentials.
Defined behaviour: Could not establish a network connection to remote server. (our description of the condition this code reports)
What you actually see
The client fails immediately with a connection error and no OPC UA detail - no endpoint list, no certificate prompt, no session.
Why it happens
- The server is not listening on that portThe OPC UA server option is not enabled, the service is stopped, or it bound to a different port. On a PLC the OPC UA server is frequently a separate option that must be switched on and downloaded before anything listens on 4840.
- Firewall or ACL blocking the portA refused connection means something actively sent a reset; a hang followed by a timeout usually means a firewall silently dropped the packets. Cross-layer traffic in Purdue-style networks is the usual victim, and it is exactly why reverse connect exists.
- Wrong port for the transport4840 is the registered opc.tcp and LDS port, 4843 the registered default for secure WebSockets and DTLS in the reference stack, 58810 a common GDS endpoint, and 65300 a common client-side reverse-connect listener. Non-default ports are widespread, for example 62541 for the Milo demo server and 26543 for the node-opcua demo.
- Name resolution failure or a stale addressThe hostname resolves to nothing, or to an old DHCP address. In containers and Kubernetes it may resolve to an address that is not routable from the client's network namespace.
- The server bound only to localhostA server configured with a loopback or container-internal bind address answers on the machine itself and refuses everything else. This looks like a firewall problem but is a bind-address problem.
How to fix it
In diagnostic order: work down, do not skip ahead.
- Test TCP reachabilitync -vz plc01 4840 on Linux or macOS, Test-NetConnection plc01 -Port 4840 on Windows. Note whether you get an immediate refusal, a timeout, or success - each points at a different layer.
- Confirm something is listening on the serverOn the server itself run ss -ltnp | grep 4840 or netstat -ano | findstr 4840. If nothing is listening, the problem is the server application or its configuration, not the network.
- Check the bind address, not just the portA listener on 127.0.0.1:4840 will never answer a remote client. Configure the server to bind all interfaces or the specific interface clients use.
- Work the firewall path hop by hopTest from the server itself, then from the same subnet, then from the client subnet. The hop where behaviour changes from success to timeout is where the rule is. Ask for an outbound-only rule and use reverse connect if inbound is refused.
- Use reverse connect across network layersConfigure the server to dial the client's listener - commonly port 65300 - so only an outbound connection from the lower layer is needed. OPC Publisher listens for reverse connect on 4840 by default and supports it only for opc.tcp.
- Then continue the standard diagnostic orderOnce the socket answers, call GetEndpoints with security None, inspect the EndpointDescriptions, and only then attempt a secure session.
Where it shows up, by tool and stack
| Tool / stack | What to do there |
|---|---|
| UaExpert | Reports the failure in the Log view before any endpoint appears in the discovery tree. If discovery shows nothing at all, you are at the TCP layer, not the OPC UA layer. |
| Siemens S7-1500 | The OPC UA server must be enabled in the device configuration and the project downloaded before port 4840 is open. A runtime licence may also be required - confirm the current requirement against Siemens documentation for your firmware. |
| Beckhoff TwinCAT | The OPC UA server runs as a separate service on the machine, so it may be stopped even while the PLC runtime is happily running. Check the service state before blaming the network. |
| open62541 (C) | UA_ServerConfig_setDefaultWithBufferSize and friends set the port; the server logs the listening endpoints on startup. Grep the startup output for the actual bound URLs. |
| Kubernetes | A ClusterIP service is not reachable from outside the cluster. Expose opc.tcp with a NodePort or LoadBalancer service, and remember that multiple replicas break secure channels. |
| OPC Publisher | Supports reverse connect for opc.tcp only, listens on 4840 by default, and opens the port lazily on first need. A LISTENING socket persisting after a session is established is expected, not a leak. |
What it looks like in the log
BadConnectionRejected: Could not establish a network connection to remote server opc.tcp://plc01:4840
connect ECONNREFUSED 10.20.3.15:4840
Socket connect to plc01:4840 timed out after 10000 msConfirm the fix
nc -vz succeeds from the client host, then GetEndpoints with security None returns a non-empty endpoint list from the same address.
Stop it happening again
Document the port and bind address for every OPC UA server at commissioning, and prefer reverse connect over inbound firewall exceptions when crossing network layers.
Related status codes
Concepts on this page
Stuck on more than one of these? The troubleshooting clinic works through broken configurations end to end, on camera.
Troubleshooting clinic →Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.