Reverse connect
Reverse connect inverts who dials. The server opens the TCP connection outbound to a client that is listening, sends a ReverseHello, and the client then runs the normal Hello, OpenSecureChannel, CreateSession sequence on that same socket. It exists so a plant-floor server needs no inbound firewall rule, which is what Purdue-layered networks require.
Why it exists
In an ISA-95 or Purdue layered network, connections from a higher level down into the cell layer are exactly what the architecture forbids. Reverse connect satisfies it: only an outbound port from the lower layer is opened, and the client - the data collector, historian or edge gateway - listens. One client-side listener port serves many servers; clients register their expectations per serverUri and endpointUrl. Port 65300 is a common listener choice, and OPC Publisher listens on 4840 by default.
The non-obvious secure-connect behaviour
To connect securely, the client must first obtain the server certificate, which means calling GetEndpoints - and that call closes the channel. The client must then wait for the server's next ReverseHello before it can open a secure channel with the cached security information. Naive implementations therefore look as if they connect and immediately drop. The connection succeeds on the following ReverseHello, one server retry interval later.
Refusal is a defined protocol behaviour
A client that does not support reverse connect, or that does not want this server's connection, replies with BadTcpMessageTypeInvalid. Per specification the server must then abort its automatic reconnect attempts for that client. Clients can use that deliberately to tell a server to stop calling. It also means a stray BadTcpMessageTypeInvalid in a server log is usually a client-side configuration gap, not corruption.
Example
The secure reverse-connect sequence, including the extra wait
server -> client ReverseHello (RHE) ServerUri, EndpointUrl
client -> server Hello (HEL) ... GetEndpoints ... channel closed
[client now holds the server certificate, and waits]
server -> client ReverseHello (RHE) <- next retry cycle
client -> server Hello, OpenSecureChannel, CreateSession, ActivateSession
session established
A LISTENING socket that persists after the session is established is expected,
not a leak: the listener serves further servers and further reconnects.Defined in: Part 6 - Mappings defines the ReverseHello message in the OPC UA TCP protocol.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.