# Industrial Protocol Ports Reference: Default TCP and UDP Ports for OT and Plant IT > Source: https://netray.co/tools/industrial-protocol-tcp-udp-ports-reference > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A searchable table of default ports for industrial protocols and the IT services a plant depends on, built for firewall rule requests and conduit reviews. ## Category industry-templates ## Industry Discrete Manufacturing ## Audience - IT manager - Network engineer - OT security engineer - Controls engineer ## Tool **Kind:** worksheet **Mode:** reference **Columns:** #### Protocol or service **Key:** protocol **Type:** text #### Default port **Key:** port **Type:** text #### Transport **Key:** transport **Type:** text #### Group **Key:** group **Type:** text #### Typical use in a plant **Key:** use **Type:** text #### Firewall note **Key:** note **Type:** text **Rows:** **Protocol:** Modbus TCP **Port:** 502 **Transport:** TCP **Group:** Industrial **Use:** PLC, drive and meter register access **Note:** No authentication in the protocol; restrict by source address **Protocol:** EtherNet/IP explicit messaging **Port:** 44818 **Transport:** TCP and UDP **Group:** Industrial **Use:** CIP configuration and tag reads on Rockwell and other CIP devices **Note:** Allow only from engineering and SCADA hosts **Protocol:** EtherNet/IP implicit I/O **Port:** 2222 **Transport:** UDP **Group:** Industrial **Use:** Cyclic I/O between controller and adapters **Note:** Usually stays inside one cell zone **Protocol:** PROFINET RT and CM **Port:** 34962 to 34964 **Transport:** UDP **Group:** Industrial **Use:** Connection management and RPC endpoint for PROFINET devices **Note:** Cyclic real-time frames are layer 2 and do not use IP ports **Protocol:** OPC UA binary **Port:** 4840 **Transport:** TCP **Group:** Industrial **Use:** OPC UA server to client, MES and historian links **Note:** Registered port; many vendors let you change it **Protocol:** OPC UA over HTTPS **Port:** 4843 **Transport:** TCP **Group:** Industrial **Use:** OPC UA with HTTPS transport **Note:** Less common than binary **Protocol:** OPC Classic (DA, HDA, A&E) **Port:** 135 plus dynamic RPC range **Transport:** TCP **Group:** Industrial **Use:** DCOM based OPC between Windows hosts **Note:** Wide dynamic range makes firewalling hard; use a tunnelling gateway or move to OPC UA **Protocol:** Siemens S7comm **Port:** 102 **Transport:** TCP **Group:** Industrial **Use:** Programming and data access on S7-300 and S7-400, and S7-1200/1500 with PUT/GET **Note:** Same ISO-TSAP port as IEC 61850 MMS **Protocol:** IEC 61850 MMS **Port:** 102 **Transport:** TCP **Group:** Industrial **Use:** Substation and power monitoring clients **Note:** Seen in plants with their own substation **Protocol:** IEC 60870-5-104 **Port:** 2404 **Transport:** TCP **Group:** Industrial **Use:** Telecontrol of power and utility assets **Note:** Restrict to the utility interface zone **Protocol:** DNP3 **Port:** 20000 **Transport:** TCP and UDP **Group:** Industrial **Use:** Utility and water SCADA links **Note:** Rare in discrete plants, common in water and energy **Protocol:** BACnet/IP **Port:** 47808 **Transport:** UDP **Group:** Industrial **Use:** Building automation, HVAC and cleanroom controls **Note:** Uses broadcast discovery; keep in its own VLAN **Protocol:** Omron FINS **Port:** 9600 **Transport:** UDP and TCP **Group:** Industrial **Use:** Omron PLC memory access **Note:** Configurable per PLC **Protocol:** Beckhoff ADS **Port:** 48898 **Transport:** TCP **Group:** Industrial **Use:** TwinCAT ADS over TCP **Note:** Needs an ADS route configured on both sides **Protocol:** FANUC FOCAS2 Ethernet **Port:** 8193 **Transport:** TCP **Group:** Industrial **Use:** Machine data collection from FANUC CNC controls **Note:** Common default; confirm on the CNC **Protocol:** MTConnect agent **Port:** 5000 **Transport:** TCP **Group:** Industrial **Use:** HTTP/XML machine data feed **Note:** Agent default; sites often change it **Protocol:** MQTT **Port:** 1883 **Transport:** TCP **Group:** Messaging **Use:** Unencrypted broker traffic for IIoT gateways **Note:** Prefer 8883 with TLS **Protocol:** MQTT over TLS **Port:** 8883 **Transport:** TCP **Group:** Messaging **Use:** Encrypted broker traffic **Note:** Preferred over 1883 **Protocol:** AMQP **Port:** 5672 **Transport:** TCP **Group:** Messaging **Use:** Message queue between MES and ERP integration layers **Note:** 5671 for AMQP over TLS **Protocol:** PTP (IEEE 1588) **Port:** 319 and 320 **Transport:** UDP **Group:** Time **Use:** Precision time for motion and sequence-of-events **Note:** Multicast; needs PTP aware switches **Protocol:** NTP **Port:** 123 **Transport:** UDP **Group:** Time **Use:** Time sync for servers, historians and HMIs **Note:** Point OT zones at an internal time source **Protocol:** DNS **Port:** 53 **Transport:** UDP and TCP **Group:** Core IT **Use:** Name resolution **Note:** Use internal resolvers in OT zones **Protocol:** DHCP **Port:** 67 and 68 **Transport:** UDP **Group:** Core IT **Use:** Address assignment for HMIs and laptops **Note:** Many OT devices use static addresses **Protocol:** Kerberos **Port:** 88 **Transport:** TCP and UDP **Group:** Core IT **Use:** Active Directory authentication **Note:** Needed to a domain controller if OT hosts are domain joined **Protocol:** LDAP **Port:** 389 **Transport:** TCP and UDP **Group:** Core IT **Use:** Directory queries **Note:** Prefer LDAPS **Protocol:** LDAPS **Port:** 636 **Transport:** TCP **Group:** Core IT **Use:** Encrypted directory queries **Note:** Global catalog TLS is 3269 **Protocol:** SMB **Port:** 445 **Transport:** TCP **Group:** Core IT **Use:** File shares and print **Note:** Block between zones unless a named share is required **Protocol:** RPC endpoint mapper **Port:** 135 **Transport:** TCP **Group:** Core IT **Use:** Windows RPC, remote management, DCOM **Note:** Needs the dynamic RPC range as well **Protocol:** WinRM **Port:** 5985 and 5986 **Transport:** TCP **Group:** Core IT **Use:** PowerShell remoting over HTTP and HTTPS **Note:** Use 5986 where possible **Protocol:** RDP **Port:** 3389 **Transport:** TCP and UDP **Group:** Core IT **Use:** Remote desktop to servers and jump hosts **Note:** Never expose to the Internet; use a gateway with MFA **Protocol:** SSH **Port:** 22 **Transport:** TCP **Group:** Core IT **Use:** Admin access to Linux servers and network gear **Note:** Restrict to admin subnets **Protocol:** HTTP **Port:** 80 **Transport:** TCP **Group:** Core IT **Use:** Web interfaces and redirects **Note:** Redirect to 443 **Protocol:** HTTPS **Port:** 443 **Transport:** TCP **Group:** Core IT **Use:** ERP web clients, APIs, vendor portals **Note:** Inspect and log outbound **Protocol:** SMTP submission **Port:** 587 **Transport:** TCP **Group:** Core IT **Use:** Alert and report email from servers **Note:** Port 25 for relay between servers **Protocol:** SNMP **Port:** 161 **Transport:** UDP **Group:** Monitoring **Use:** Switch, UPS and printer polling **Note:** Use SNMPv3, restrict to the monitoring host **Protocol:** SNMP traps **Port:** 162 **Transport:** UDP **Group:** Monitoring **Use:** Device alerts to the NMS **Note:** Collector address only **Protocol:** Syslog **Port:** 514 **Transport:** UDP **Group:** Monitoring **Use:** Log forwarding from network and OT gear **Note:** 6514 TCP for syslog over TLS **Protocol:** Microsoft SQL Server **Port:** 1433 **Transport:** TCP **Group:** Database **Use:** ERP and MES databases (SyteLine, Epicor, Dynamics, many MES products) **Note:** Allow only from application servers; SQL Browser uses 1434 UDP for named instances **Protocol:** Oracle listener **Port:** 1521 **Transport:** TCP **Group:** Database **Use:** Oracle EBS, JD Edwards and Oracle based MES **Note:** Application tier only **Protocol:** PostgreSQL **Port:** 5432 **Transport:** TCP **Group:** Database **Use:** Open source and some MES or historian back ends **Note:** Application tier only **Protocol:** MySQL and MariaDB **Port:** 3306 **Transport:** TCP **Group:** Database **Use:** Web and small application databases **Note:** Application tier only **Protocol:** IPsec IKE **Port:** 500 **Transport:** UDP **Group:** VPN **Use:** Site to site and vendor VPN negotiation **Note:** NAT traversal uses 4500 UDP **Protocol:** IPsec NAT traversal **Port:** 4500 **Transport:** UDP **Group:** VPN **Use:** IPsec behind NAT **Note:** Pair with the IKE rule **Notes:** These are default or registered ports. Vendors and integrators change them, so confirm on the device or in the product manual before writing a firewall rule. Treat the firewall note as a starting point for a conduit review, not a policy. ## Content **Intro:** When a vendor asks you to open ports to a plant floor device, you need the default port, the transport and a sense of how risky the protocol is. This table collects the industrial protocols and the plant IT services you meet most often, so you can search once and move on. **Sections:** #### How to use the table **Body:** Type a protocol name or a port number into the search box, or filter by group. Use the result to draft the firewall change request: source zone, destination zone, port, transport and the business reason. Export the filtered rows to Excel to attach to a change record or a vendor questionnaire. Always verify the port on the actual device because many controllers and servers let you change it. **Bullets:** - Search by port number to identify an unknown flow in a firewall log - Filter to Industrial to review what your OT zones must allow - Filter to Database to check what an ERP or MES server needs from the application tier - Attach the export to the change request as the evidence for each rule #### Why the Purdue-style zoning matters for ports **Body:** Most industrial protocols were designed for trusted networks and have no authentication or encryption. Modbus TCP, S7comm without added protection and Classic OPC all assume that anyone who can reach the port is allowed to use it. That is why ports should be opened between named hosts only, and why traffic between the plant network and the corporate network should pass through a controlled conduit such as a firewall and a demilitarised zone for historians and MES gateways. **Bullets:** - Prefer OPC UA with signing and encryption to Classic OPC over DCOM - Prefer MQTT on 8883 to 1883 - Never forward RDP or an engineering protocol directly from the Internet #### Reading the firewall notes **Body:** Cyclic real-time traffic such as PROFINET RT is carried at layer 2 and normally never crosses a router, so you do not write a rule for it. Protocols that use dynamic ranges, such as DCOM, are hard to firewall tightly and are a reason to move to OPC UA or place a gateway in the DMZ. Port 102 is shared by Siemens S7comm and IEC 61850 MMS, so the port alone does not tell you which one a device speaks. #### Common mistakes **Body:** The most frequent errors are opening a port range because one port did not work, allowing any source instead of the named client, and forgetting return traffic or time and DNS services that the device silently depends on. Another is assuming the default: a CNC or PLC integrator may have moved the service to another port. Capture a short packet trace or read the device configuration before you finalise the rule. **Cta:** If you want plant, ERP and MES data available to a private AI assistant without opening new inbound paths, Netray can design a read-only connector that fits your zone model. **Faq:** #### Is Modbus TCP on port 502 secure? **Answer:** The base protocol has no authentication or encryption, so anyone who reaches port 502 can read and often write registers. Restrict it to specific client addresses, keep it inside a cell or area zone, and consider a Modbus aware firewall or a gateway if it must cross zones. #### What port does OPC UA use? **Answer:** The registered port for OPC UA binary is 4840 TCP and 4843 for HTTPS transport. Many server products let you change it, and a single machine can host several endpoints, so confirm the endpoint URL in the server configuration. #### Do I need a firewall rule for PROFINET? **Answer:** Real-time PROFINET frames are layer 2 and stay inside the local network, so they do not cross a router. Only the UDP management and RPC traffic on ports 34962 to 34964 may need a rule, and usually only for engineering access. #### Which ports does an ERP database server need? **Answer:** It depends on the database. SQL Server uses 1433 TCP by default, Oracle listeners use 1521, and PostgreSQL uses 5432. Allow them only from the application servers and admin hosts, and add monitoring, backup and directory services separately. ## Search terms modbus tcp port, opc ua default port 4840, ethernet/ip port 44818, profinet ports firewall, industrial protocol ports list, s7comm port 102, ot firewall rules ports, plc communication ports --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json