Industry TemplatesFree referencePDF, Excel, Word exportDiscrete Manufacturing

Industrial Protocol Ports Reference: Default TCP and UDP Ports for OT and Plant IT

When a vendor asks you to open ports to a plant floor device, you need the default port, the transport and a sense of how risky the protocol is. This table collects the industrial protocols and the plant IT services you meet most often, so you can search once and move on.

Download:

Protocol or service	Default port	Transport	Group	Typical use in a plant	Firewall note
Modbus TCP	502	TCP	Industrial	PLC, drive and meter register access	No authentication in the protocol; restrict by source address
EtherNet/IP explicit messaging	44818	TCP and UDP	Industrial	CIP configuration and tag reads on Rockwell and other CIP devices	Allow only from engineering and SCADA hosts
EtherNet/IP implicit I/O	2222	UDP	Industrial	Cyclic I/O between controller and adapters	Usually stays inside one cell zone
PROFINET RT and CM	34962 to 34964	UDP	Industrial	Connection management and RPC endpoint for PROFINET devices	Cyclic real-time frames are layer 2 and do not use IP ports
OPC UA binary	4840	TCP	Industrial	OPC UA server to client, MES and historian links	Registered port; many vendors let you change it
OPC UA over HTTPS	4843	TCP	Industrial	OPC UA with HTTPS transport	Less common than binary
OPC Classic (DA, HDA, A&E)	135 plus dynamic RPC range	TCP	Industrial	DCOM based OPC between Windows hosts	Wide dynamic range makes firewalling hard; use a tunnelling gateway or move to OPC UA
Siemens S7comm	102	TCP	Industrial	Programming and data access on S7-300 and S7-400, and S7-1200/1500 with PUT/GET	Same ISO-TSAP port as IEC 61850 MMS
IEC 61850 MMS	102	TCP	Industrial	Substation and power monitoring clients	Seen in plants with their own substation
IEC 60870-5-104	2404	TCP	Industrial	Telecontrol of power and utility assets	Restrict to the utility interface zone
DNP3	20000	TCP and UDP	Industrial	Utility and water SCADA links	Rare in discrete plants, common in water and energy
BACnet/IP	47808	UDP	Industrial	Building automation, HVAC and cleanroom controls	Uses broadcast discovery; keep in its own VLAN
Omron FINS	9600	UDP and TCP	Industrial	Omron PLC memory access	Configurable per PLC
Beckhoff ADS	48898	TCP	Industrial	TwinCAT ADS over TCP	Needs an ADS route configured on both sides
FANUC FOCAS2 Ethernet	8193	TCP	Industrial	Machine data collection from FANUC CNC controls	Common default; confirm on the CNC
MTConnect agent	5000	TCP	Industrial	HTTP/XML machine data feed	Agent default; sites often change it
MQTT	1883	TCP	Messaging	Unencrypted broker traffic for IIoT gateways	Prefer 8883 with TLS
MQTT over TLS	8883	TCP	Messaging	Encrypted broker traffic	Preferred over 1883
AMQP	5672	TCP	Messaging	Message queue between MES and ERP integration layers	5671 for AMQP over TLS
PTP (IEEE 1588)	319 and 320	UDP	Time	Precision time for motion and sequence-of-events	Multicast; needs PTP aware switches
NTP	123	UDP	Time	Time sync for servers, historians and HMIs	Point OT zones at an internal time source
DNS	53	UDP and TCP	Core IT	Name resolution	Use internal resolvers in OT zones
DHCP	67 and 68	UDP	Core IT	Address assignment for HMIs and laptops	Many OT devices use static addresses
Kerberos	88	TCP and UDP	Core IT	Active Directory authentication	Needed to a domain controller if OT hosts are domain joined
LDAP	389	TCP and UDP	Core IT	Directory queries	Prefer LDAPS
LDAPS	636	TCP	Core IT	Encrypted directory queries	Global catalog TLS is 3269
SMB	445	TCP	Core IT	File shares and print	Block between zones unless a named share is required
RPC endpoint mapper	135	TCP	Core IT	Windows RPC, remote management, DCOM	Needs the dynamic RPC range as well
WinRM	5985 and 5986	TCP	Core IT	PowerShell remoting over HTTP and HTTPS	Use 5986 where possible
RDP	3389	TCP and UDP	Core IT	Remote desktop to servers and jump hosts	Never expose to the Internet; use a gateway with MFA
SSH	22	TCP	Core IT	Admin access to Linux servers and network gear	Restrict to admin subnets
HTTP	80	TCP	Core IT	Web interfaces and redirects	Redirect to 443
HTTPS	443	TCP	Core IT	ERP web clients, APIs, vendor portals	Inspect and log outbound
SMTP submission	587	TCP	Core IT	Alert and report email from servers	Port 25 for relay between servers
SNMP	161	UDP	Monitoring	Switch, UPS and printer polling	Use SNMPv3, restrict to the monitoring host
SNMP traps	162	UDP	Monitoring	Device alerts to the NMS	Collector address only
Syslog	514	UDP	Monitoring	Log forwarding from network and OT gear	6514 TCP for syslog over TLS
Microsoft SQL Server	1433	TCP	Database	ERP and MES databases (SyteLine, Epicor, Dynamics, many MES products)	Allow only from application servers; SQL Browser uses 1434 UDP for named instances
Oracle listener	1521	TCP	Database	Oracle EBS, JD Edwards and Oracle based MES	Application tier only
PostgreSQL	5432	TCP	Database	Open source and some MES or historian back ends	Application tier only
MySQL and MariaDB	3306	TCP	Database	Web and small application databases	Application tier only
IPsec IKE	500	UDP	VPN	Site to site and vendor VPN negotiation	NAT traversal uses 4500 UDP
IPsec NAT traversal	4500	UDP	VPN	IPsec behind NAT	Pair with the IKE rule

These are default or registered ports. Vendors and integrators change them, so confirm on the device or in the product manual before writing a firewall rule. Treat the firewall note as a starting point for a conduit review, not a policy.

Review your plant firewall rules

Send us your rule export and we will point out rules that are broader than the protocol requires. Optional, no obligation.

Optional. The tool and every export work without this. No spam.

How to use the table

Type a protocol name or a port number into the search box, or filter by group. Use the result to draft the firewall change request: source zone, destination zone, port, transport and the business reason. Export the filtered rows to Excel to attach to a change record or a vendor questionnaire. Always verify the port on the actual device because many controllers and servers let you change it.

Search by port number to identify an unknown flow in a firewall log
Filter to Industrial to review what your OT zones must allow
Filter to Database to check what an ERP or MES server needs from the application tier
Attach the export to the change request as the evidence for each rule

Why the Purdue-style zoning matters for ports

Most industrial protocols were designed for trusted networks and have no authentication or encryption. Modbus TCP, S7comm without added protection and Classic OPC all assume that anyone who can reach the port is allowed to use it. That is why ports should be opened between named hosts only, and why traffic between the plant network and the corporate network should pass through a controlled conduit such as a firewall and a demilitarised zone for historians and MES gateways.

Prefer OPC UA with signing and encryption to Classic OPC over DCOM
Prefer MQTT on 8883 to 1883
Never forward RDP or an engineering protocol directly from the Internet

Reading the firewall notes

Cyclic real-time traffic such as PROFINET RT is carried at layer 2 and normally never crosses a router, so you do not write a rule for it. Protocols that use dynamic ranges, such as DCOM, are hard to firewall tightly and are a reason to move to OPC UA or place a gateway in the DMZ. Port 102 is shared by Siemens S7comm and IEC 61850 MMS, so the port alone does not tell you which one a device speaks.

Common mistakes

The most frequent errors are opening a port range because one port did not work, allowing any source instead of the named client, and forgetting return traffic or time and DNS services that the device silently depends on. Another is assuming the default: a CNC or PLC integrator may have moved the service to another port. Capture a short packet trace or read the device configuration before you finalise the rule.

Frequently Asked Questions

Is Modbus TCP on port 502 secure?

The base protocol has no authentication or encryption, so anyone who reaches port 502 can read and often write registers. Restrict it to specific client addresses, keep it inside a cell or area zone, and consider a Modbus aware firewall or a gateway if it must cross zones.

What port does OPC UA use?

The registered port for OPC UA binary is 4840 TCP and 4843 for HTTPS transport. Many server products let you change it, and a single machine can host several endpoints, so confirm the endpoint URL in the server configuration.

Do I need a firewall rule for PROFINET?

Real-time PROFINET frames are layer 2 and stay inside the local network, so they do not cross a router. Only the UDP management and RPC traffic on ports 34962 to 34964 may need a rule, and usually only for engineering access.

Which ports does an ERP database server need?

It depends on the database. SQL Server uses 1433 TCP by default, Oracle listeners use 1521, and PostgreSQL uses 5432. Allow them only from the application servers and admin hosts, and add monitoring, backup and directory services separately.

If you want plant, ERP and MES data available to a private AI assistant without opening new inbound paths, Netray can design a read-only connector that fits your zone model.

Talk to an Expert Explore More Free Tools

Related Tools

Industry Templates

More Industry Templates tools

See all

Back to All Tools