Developer ToolsFree referencePDF, Excel, Word exportManufacturing

Common OT and ICS Protocol Ports Reference

When you write a firewall rule between the office and the plant you need the port, the transport and some sense of the risk. This table puts the common industrial and supporting IT ports in one filterable list.

Download:

Port	Transport	Protocol or service	Typically seen on	Firewall note
20	TCP	FTP data	Legacy file transfer	Cleartext. Replace with SFTP.
21	TCP	FTP control	Machine tool and PLC backups	Cleartext credentials. Block between zones.
22	TCP	SSH and SFTP	Linux gateways, switches	Allow only from jump host.
23	TCP	Telnet	Old switches and controllers	Cleartext. Disable.
53	TCP/UDP	DNS	All networks	Restrict to approved resolvers.
69	UDP	TFTP	Firmware and config loads	No authentication. Allow briefly.
88	TCP/UDP	Kerberos	Windows domain	Needed to domain controllers only.
102	TCP	Siemens S7comm and ISO-TSAP, also IEC 61850 MMS	Siemens PLCs	Allow only from engineering stations and HMIs.
123	UDP	NTP	Time sync	Use an internal time source.
135	TCP	RPC endpoint mapper, used by classic OPC DCOM	Windows, OPC Classic	Wide dynamic range follows. Prefer OPC UA.
161	UDP	SNMP	Switches, UPS, printers	Use SNMPv3, restrict to monitoring server.
162	UDP	SNMP trap	Monitoring server	Inbound to monitoring only.
389	TCP/UDP	LDAP	Directory lookups	Prefer LDAPS on 636.
443	TCP	HTTPS	Web HMIs, cloud connectors, APIs	Inspect and limit destinations.
445	TCP	SMB	File shares, Windows hosts	Primary ransomware spread path. Block between zones.
502	TCP	Modbus TCP	PLCs, meters, drives	No authentication. Allow specific master to slave pairs only.
636	TCP	LDAPS	Directory lookups over TLS	Preferred over 389.
1433	TCP	Microsoft SQL Server	ERP, MES, historians	Allow only from app servers.
1521	TCP	Oracle listener (default)	Oracle databases	Allow only from app servers.
1883	TCP	MQTT	IIoT brokers	Cleartext. Use 8883 with TLS.
2222	UDP	EtherNet/IP implicit I/O	Rockwell and ODVA devices	Cyclic I/O. Keep inside the cell.
2404	TCP	IEC 60870-5-104	Utility and substation links	No native security. Isolate.
3389	TCP	RDP	Remote administration	Never expose to the internet. Jump host only.
4840	TCP	OPC UA (default)	Gateways, MES connectors	Use signed and encrypted endpoints.
5000	TCP	MTConnect agent (common default)	CNC data collection	Read only data, but still restrict.
5900	TCP	VNC	HMIs, remote screens	Weak auth often. Tunnel through jump host.
5985	TCP	WinRM HTTP	PowerShell remoting	Admin hosts only.
5986	TCP	WinRM HTTPS	PowerShell remoting over TLS	Admin hosts only.
8193	TCP	FANUC FOCAS (default)	FANUC CNC controls	Allow only from collection server.
8883	TCP	MQTT over TLS	IIoT brokers	Preferred to 1883.
9600	UDP/TCP	Omron FINS	Omron PLCs	No authentication by default.
20000	TCP/UDP	DNP3	Utilities, water, oil and gas	Limited native security. Isolate.
34980	UDP	EtherCAT over UDP	EtherCAT segments	Keep local to the machine network.
44818	TCP/UDP	EtherNet/IP explicit messaging (CIP)	Rockwell and ODVA devices	Allow from engineering station only.
47808	UDP	BACnet/IP	Building automation	Keep in a separate building zone.

These are default ports. Vendors and integrators change them, so confirm with a passive capture or the device manual before writing a firewall rule. A port number alone does not prove which protocol is running.

Plant firewall rule review

Optional review of your plant-to-office rules against this list.

Optional. The tool and every export work without this. No spam.

How to use it

Search by protocol name or port to find what a flow in a firewall log probably is. Use the typical column to guess which device class is talking. Use the note column when drafting a rule: it tells you which side should initiate and what to avoid. Export to Excel to attach to a firewall change request or an OT network design.

Search 502 to find Modbus TCP rules fast
Compare cleartext protocols against their secure variants
Attach the export to the change request

Why defaults matter

Most industrial protocols were designed for isolated networks, so many have no authentication or encryption. A firewall that allows port 502 from the whole office subnet gives every laptop write access to a controller. Rules should name a specific master and specific slaves, and be limited to the direction the protocol needs.

Verifying what actually runs

Defaults can be changed and many devices answer on unexpected ports. Before blocking anything on a live line, capture traffic from a mirror port for a full production cycle and compare it with this list. Block in monitor mode first, review the hits and then enforce. Unplanned blocks of cyclic I/O can stop a machine.

Common mistakes

Allowing any to any on SMB between plant and office is the usual ransomware path. Leaving RDP and VNC open to vendors without a jump host is the second. Remember also that classic OPC over DCOM needs a wide dynamic port range, which is one more reason to move to OPC UA with a single configurable port.

Frequently Asked Questions

Is Modbus TCP secure?

No. Standard Modbus TCP has no authentication or encryption, so any host that can reach port 502 can read and write registers. Protect it with segmentation, allow lists and, where available, a secure Modbus variant.

Which OPC UA port should I use?

4840 is the registered default for discovery and many servers, but servers can run on any port. Check the endpoint URL in the server configuration and use signed and encrypted security modes.

Why is 445 flagged so often?

SMB is the main way ransomware moves between Windows hosts. Blocking it between zones, and between workstations, removes a large share of lateral movement paths.

Does a port tell me the protocol?

Not reliably. It is a strong hint only. Confirm with a packet capture or an OT monitoring tool that understands the protocol before building rules on the assumption.

If you need a ready-made firewall rule review for your plant network, Netray can map your flows to this list with you.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Developer Tools tools

See all

Back to All Tools