Port 4840
4840/tcp is the registered default port for opc.tcp and for the Local Discovery Server. Related defaults worth knowing: 4843 for secure WebSocket and DTLS, 58810 commonly for a Global Discovery Server, 65300 as a client reverse-connect listener, UDP 5353 for mDNS discovery and 224.0.2.14:4840 for PubSub UDP multicast.
Why so many servers are not on 4840
If a Local Discovery Server is installed on a host it binds 4840 first, so every other server on that machine must move. Vendors also pick their own defaults for embedded servers and gateways. The practical consequence is that scanning or hardcoding 4840 finds a fraction of the servers in a plant; the reliable path is to ask the LDS with FindServers, or to take the port from the documented endpoint URL.
Firewall rules that actually work
For a normal client-dials-server design you need outbound from the client subnet to the server on the endpoint port, and nothing else - OPC UA client/server uses a single TCP connection with no dynamic data port, unlike DCOM-era OPC. For reverse connect the rule inverts: outbound from the server layer to the collector's listener port, so the cell layer never accepts an inbound connection. PubSub adds UDP multicast, which is a separate conversation with the network team.
An open port is not a working server
A successful TCP handshake proves only the first of four establishment stages. The server may reject the security policy, refuse the identity token, or be a completely different service that happens to hold the port. Prove reachability, then immediately call GetEndpoints with security None; the difference between a connection refused, a connection accepted then closed, and a valid endpoint list is the whole diagnosis.
Example
The ports worth memorising, and the first two diagnostic commands
# 4840/tcp opc.tcp and the Local Discovery Server
# 4843/tcp secure WebSocket and DTLS defaults
# 58810/tcp commonly a Global Discovery Server endpoint
# 65300/tcp common client-side reverse-connect listener
# 5353/udp mDNS, used by FindServersOnNetwork
# 224.0.2.14:4840/udp PubSub UDP multicast discovery
nc -vz opcua.umati.app 4840
nc -vz milo.digitalpetri.com 62541 # a public server that is not on 4840Defined in: Part 6 - Mappings for the transport defaults; Part 12 - Discovery and Global Services for the LDS.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.