Skip to main content
OPC UA Relayby SterfiveSign in

Reach your OPC UA servers behind firewalls, without opening inbound ports.

A small agent on your site opens an outbound, encrypted connection. Your OPC UA clients then reach the servers you choose through a public address, and the agent listens on no network port.

Sign upSign in

How it works

OPC UA Relay lets an OPC UA client reach servers inside a private network, from anywhere, without an inbound firewall rule. Setting it up takes four steps.

  1. Get the agent. Sign in, download the agent from the dashboard and run it on one machine in your private network, one that can reach your OPC UA server.
  2. Approve it. The agent prints a code and a link. Open the link while signed in, compare the code and approve the request. Nothing is enrolled before you do.
  3. Add a server. Give the agent the address of your OPC UA server. It registers the server with the relay, and the dashboard shows the server's public address, which carries its own random routing key.
  4. Connect a client. Give your OPC UA client that address, opc.tcp://opcua.sterfive.io:19876/<routing key>. Your server must also list that address among the endpoints it advertises: the dashboard tests this and explains the one setting to change.
How a request reaches your OPC UA serverAn OPC UA client connects to opcua.sterfive.io on port 19876. The relay run by Sterfive passes the request through an outbound tunnel that the agent opened from inside your network, on port 443. The agent then connects to your OPC UA server. The agent and the server sit behind your firewall, with no inbound port open.Run by SterfiveYour site, behind your firewallOutbound tunnelAgent-initiatedTLS, port 443OPC UA clientOn the internetor in your cloudopcua.sterfive.ioPublic entryTCP port 19876RelayRun by SterfiveAgentOpens nolistening portOPC UA serverOnly if it ison your list

The same path in words

  1. An OPC UA client connects to opcua.sterfive.io on TCP port 19876, using the address of one published server.
  2. The relay, run by Sterfive, finds the server that address names.
  3. The agent, inside your network, opened an outbound TLS connection to tunnel.sterfive.io on port 443 and keeps it open. The relay sends the request through that connection.
  4. The agent checks the request against your list, opens a connection to your OPC UA server and passes the bytes in both directions.
  5. No inbound port is open at your site.

Security, in plain words

This is what is in place today, and where it stops. We describe a control only when it is released and tested.

  • The agent only calls out

    The agent opens an outbound connection to Sterfive and keeps it open. It opens no listening port, so your firewall needs no inbound rule. It connects to two hosts only, www.sterfive.io and tunnel.sterfive.io, both on port 443.

  • The agent checks who it talks to

    The tunnel is TLS. From agent 0.1.2 the agent verifies the relay's certificate and refuses any other, so a party posing as the relay is rejected, including a proxy that decrypts and re-signs the traffic: exempt tunnel.sterfive.io from TLS inspection. A site can also pin the relay's public key; Sterfive does not publish pins yet.

  • You approve every agent

    An agent is enrolled only when a signed-in user compares the code it printed and presses Approve. Deny or expiry leaves it not enrolled. Its credential lasts 7 days and is renewed while it runs, and you can disable the agent in the dashboard at any time.

  • The agent only reaches the servers you list

    The relay can only ask the agent to open a connection, and the agent checks the target against a list kept on its own machine. Anything else is refused. Even a compromised relay could not make the agent run commands, read files or reach other hosts.

  • Each server has its own routing key

    Every published server gets a random routing key, which is part of its public address. The relay uses it to find the server a client asked for. It does not replace the access control of your own OPC UA server.

  • Your OPC UA data

    OPC UA traffic is passed through unchanged. With Sign or SignAndEncrypt the secure channel runs between the client and your server, and the relay does not hold the keys. With security mode None the messages travel in clear between the client and Sterfive's public entry point, so require Sign or SignAndEncrypt.

Limits today

  • The agent does not use a forward proxy: it ignores HTTPS_PROXY and system proxy settings.
  • OPC UA clients connect on TCP port 19876, which is not a standard port and is blocked on some networks.
  • Sterfive does not publish IP addresses yet: allow the two hostnames above.
  • When you browse a server or test a connection from the dashboard, Sterfive's backend is the OPC UA client and reads what you ask it to read.

Your IT team can ask for the network and security guide.

Use cases

Reach a server in a customer's private network

You need data from an OPC UA server that runs in a customer's or a partner's network and is not reachable from the internet. Asking them to open an inbound firewall port is unsafe, and rarely accepted.

Instead, they run the agent on one machine inside their network and publish only the servers you need. Your applications connect to the address the relay gives for each of them. The agent only opens connections toward Sterfive, never the other way round.

Reach your own sites from anywhere

Your plants and sites keep their OPC UA servers behind firewalls. Engineering, analytics or monitoring tools elsewhere, in another site, in your cloud or on a laptop on the road, read those servers through the relay with an OPC UA client, still without an inbound rule at the plant.

Get access

Create an account to try the relay on your own servers, or contact us for a pilot, for pricing (not published yet) or for the network and security guide.

Sign upContact us