Port reference
Port 4840 (TCP) – OPC UA
OPC Unified Architecture — secure, platform-independent industrial data exchange between servers, clients, and PLCs.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on OPC UA servers in PLCs, gateways, and SCADA, frequently configured with SecurityMode None and anonymous access.
What is port 4840 used for?
Port 4840 is the default for OPC UA (Unified Architecture), the modern standard for industrial data exchange. It lets software talk to PLCs, sensors, gateways, and SCADA systems to read and write process data, subscribe to changes, and call methods. It's used across factory and automation gear and by OPC UA toolkits and clients like the open62541 library, Unified Automation tools, and Prosys OPC UA clients.
When would you open it?
Open port 4840 within an industrial/OT network so SCADA, historians, and HMI software can reach an OPC UA server on a controller. Keep it inside the OT segment; it should not be reachable from the office network or the internet.
Is it safe to open?
OPC UA can be very secure, but it's often deployed with no security and anonymous access, letting anyone read and change process data. Enforce SignAndEncrypt with certificates, disable anonymous access, and keep it segmented. See the security notes below.
How to check if this port is open
ss -tulpn | grep :4840
nmap -p 4840 <target>netstat -ano | findstr :4840
Test-NetConnection <host> -Port 4840lsof -i :4840
nmap -p 4840 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 4840 to your device's local IP, internal port 4840, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 4840/tcpsudo firewall-cmd --permanent --add-port=4840/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 4840 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 4840" -Direction Inbound -Protocol TCP -LocalPort 4840 -Action AllowSecurity & risks
Common attacks
- Anonymous/None-security connections reading and writing process data
- Endpoint and namespace enumeration via GetEndpoints / opcua-info
- Exploitation of stack/server CVEs and certificate validation flaws
- Browsing the address space to map the controlled process
Hardening
- Never expose port 4840 to the internet — keep OPC UA on an OT segment
- Enforce SecurityMode SignAndEncrypt with trusted application certificates
- Disable anonymous access; require user authentication and least privilege
- Patch the OPC UA stack/server and monitor with an ICS IDS
How to block this port
sudo ufw deny 4840/tcpsudo firewall-cmd --permanent --remove-port=4840/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 4840 -j DROPNew-NetFirewallRule -DisplayName "Block 4840" -Direction Inbound -Protocol TCP -LocalPort 4840 -Action Blocknmap snippet
nmap -p4840 --script opcua-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is OPC UA secure by default?
- OPC UA can be very secure with SignAndEncrypt and certificate-based authentication, but it is frequently deployed with SecurityMode None and anonymous access, which removes all protection. Security depends entirely on configuration.
- What is the difference between OPC UA and Modbus?
- Modbus has no security at all, while OPC UA was designed with signing, encryption, and authentication. The risk with OPC UA is misconfiguration — falling back to None/anonymous makes it nearly as exposed as Modbus.