diff --git a/src/_data/chrome.json b/src/_data/chrome.json index 6ba6b99864..4c7f64bb92 100644 --- a/src/_data/chrome.json +++ b/src/_data/chrome.json @@ -217,7 +217,7 @@ }, { "label": "OPC UA", - "href": "/node-red/flowfuse/edge/opcua/", + "href": "/integrations/opcua/", "icon": "server-stack" }, { @@ -601,7 +601,7 @@ }, { "label": "OPC UA", - "href": "/node-red/flowfuse/edge/opcua/" + "href": "/integrations/opcua/" }, { "label": "RTSP", diff --git a/src/blog/2023/07/how-to-build-a-opc-client-dashboard-in-node-red.md b/src/blog/2023/07/how-to-build-a-opc-client-dashboard-in-node-red.md index 280aa35ecb..f48fca5552 100644 --- a/src/blog/2023/07/how-to-build-a-opc-client-dashboard-in-node-red.md +++ b/src/blog/2023/07/how-to-build-a-opc-client-dashboard-in-node-red.md @@ -294,7 +294,9 @@ If you're interested in learning how to use Node-RED for professional use cases, In this final article, we went over building a OPC UA Client dashboard that can browse the address space, read values from an OPC Server, write values to an OPC Server, and get events from an OPC Server. -This flow provides examples that can serve as a foundation for an interactive OPC Client application built in Node-RED. This now concludes the OPC UA Series. +This flow provides examples that can serve as a foundation for an interactive OPC Client application built in Node-RED. This now concludes the OPC UA Series. + +For a production-grade OPC UA client, maintained as a certified node with subscriptions, alarms, and historical access built in, see [FlowFuse's OPC UA client and server capabilities](/integrations/opcua/#opc-ua-client-and-server-capabilities). full source code for this project - diff --git a/src/blog/2023/07/how-to-deploy-a-basic-opc-ua-server-in-node-red.md b/src/blog/2023/07/how-to-deploy-a-basic-opc-ua-server-in-node-red.md index c6b6586ffc..7dcffb363a 100644 --- a/src/blog/2023/07/how-to-deploy-a-basic-opc-ua-server-in-node-red.md +++ b/src/blog/2023/07/how-to-deploy-a-basic-opc-ua-server-in-node-red.md @@ -297,3 +297,5 @@ In this article, we compare OPC-UA to traditional fieldbus protocols, explain th This isn't just a lab exercise: [Opto 22, one of the original vendors behind the OPC standard, ships Node-RED pre-installed on its groov EPIC edge controllers](/customer-stories/opto22-embraces-node-red/), putting this same OPC-UA server pattern into production on the factory floor. In our next article, we will build a custom OPC-UA Server in Node-RED with data pulled from an Allen Bradley PLC over Ethernet/IP, using the PLC data to develop a custom OPC UA Information Model programmed in the OPC server address space. + +For FlowFuse's production-ready OPC UA server, maintained as a certified node rather than a hand-rolled flow, see [hosting an OPC UA server](/integrations/opcua/#opc-ua-client-and-server-capabilities) on the FlowFuse OPC UA overview. diff --git a/src/blog/2024/02/connect-node-red-to-kepware-opc.md b/src/blog/2024/02/connect-node-red-to-kepware-opc.md index 513f5ad492..ba6497a7a0 100644 --- a/src/blog/2024/02/connect-node-red-to-kepware-opc.md +++ b/src/blog/2024/02/connect-node-red-to-kepware-opc.md @@ -121,4 +121,6 @@ Open up the **Quick Client** within KepserverEX and navigate to the address of * ### Conclusion -This guide was designed to help you easily connect your Node-RED instance to KepserverEX with security. For more examples of how to do more advanced configuration, please watch the past [webinar](/webinars/2023/getting-started-opcua-node-red/) going over these [examples](https://github.com/mikakaraila/node-red-contrib-opcua/tree/master/examples) in detail. +This guide was designed to help you easily connect your Node-RED instance to KepserverEX with security. For more examples of how to do more advanced configuration, please watch the past [webinar](/webinars/2023/getting-started-opcua-node-red/) going over these [examples](https://github.com/mikakaraila/node-red-contrib-opcua/tree/master/examples) in detail. + +KepServerEX is one option for an OPC UA server; see [FlowFuse's OPC UA client and server capabilities](/integrations/opcua/#opc-ua-client-and-server-capabilities) for its own certified OPC UA node, including hosting a server directly instead of going through a gateway. diff --git a/src/blog/2024/08/opc-ua-to-mqtt-with-node-red.md b/src/blog/2024/08/opc-ua-to-mqtt-with-node-red.md index 88246fbdc5..a4e166badd 100644 --- a/src/blog/2024/08/opc-ua-to-mqtt-with-node-red.md +++ b/src/blog/2024/08/opc-ua-to-mqtt-with-node-red.md @@ -187,6 +187,9 @@ _Video showing the successful bridging of OPC UA data to MQTT_ ### Up Next +- [OPC UA Client and Server on FlowFuse](/integrations/opcua/) + See FlowFuse's full OPC UA client and server capabilities, certified node, and security model in one place. + - [Using MQTT with Node-RED](/node-red/protocol/mqtt/) Learn how to integrate MQTT with Node-RED to enhance your IoT solutions with real-time data messaging. diff --git a/src/blog/2025/07/reading-and-writing-plc-data-using-opc-ua.md b/src/blog/2025/07/reading-and-writing-plc-data-using-opc-ua.md index f412873780..9699228f38 100644 --- a/src/blog/2025/07/reading-and-writing-plc-data-using-opc-ua.md +++ b/src/blog/2025/07/reading-and-writing-plc-data-using-opc-ua.md @@ -294,4 +294,4 @@ When it is time to move beyond prototypes, **FlowFuse** delivers what industrial If you’re ready to simplify your OPC UA integration and scale industrial workflows with Node-RED, [start your free trial](https://app.flowfuse.com/account/create) of FlowFuse today. -OPC UA is one of several protocols FlowFuse uses to connect PLCs to MQTT, cloud platforms, and enterprise systems. See the [FlowFuse PLC integration overview](/landing/plc/) for EtherNet/IP, Siemens S7, Modbus, and more. +For the full rundown of FlowFuse as an [OPC UA client and server](/integrations/opcua/#opc-ua-client-and-server-capabilities), certified node included, see the FlowFuse OPC UA overview. OPC UA is one of several protocols FlowFuse uses to connect PLCs to MQTT, cloud platforms, and enterprise systems, see the [FlowFuse PLC integration overview](/landing/plc/) for EtherNet/IP, Siemens S7, Modbus, and more. diff --git a/src/blog/2025/08/advanced-opcua-real-time-subscriptions-alarms-historical-data.md b/src/blog/2025/08/advanced-opcua-real-time-subscriptions-alarms-historical-data.md index c321f9696c..c13c16b698 100644 --- a/src/blog/2025/08/advanced-opcua-real-time-subscriptions-alarms-historical-data.md +++ b/src/blog/2025/08/advanced-opcua-real-time-subscriptions-alarms-historical-data.md @@ -297,6 +297,6 @@ Managing OPC UA flows across multiple sites? FlowFuse helps teams deploy Node-RE Following our managed MQTT broker, we've now added database services built right into the platform, plus new AI features that make building flows faster than ever. -Connecting PLCs beyond OPC UA? FlowFuse also supports Siemens S7, EtherNet/IP, Modbus TCP/RTU, and MQTT, see the [FlowFuse PLC integration overview](/landing/plc/) for all supported protocols and use cases. +See [OPC UA subscriptions, alarms, and historical access](/integrations/opcua/#opc-ua-client-and-server-capabilities) for how these capabilities fit into FlowFuse's broader OPC UA client and server support. Connecting PLCs beyond OPC UA? FlowFuse also supports Siemens S7, EtherNet/IP, Modbus TCP/RTU, and MQTT, see the [FlowFuse PLC integration overview](/landing/plc/) for all supported protocols and use cases. [Get started free](https://app.flowfuse.com/account/create) and scale and manage your Node-RED deployments today. diff --git a/src/blog/2026/01/eliminate-opc-ua-bottleneck-ai-agents.md b/src/blog/2026/01/eliminate-opc-ua-bottleneck-ai-agents.md index 3a4ce095d7..ca37104a51 100644 --- a/src/blog/2026/01/eliminate-opc-ua-bottleneck-ai-agents.md +++ b/src/blog/2026/01/eliminate-opc-ua-bottleneck-ai-agents.md @@ -104,6 +104,6 @@ This isn't about replacing people with automation. It's about making the data in And it's not limited to OPC UA. FlowFuse's MCP approach works the same way across any industrial system, MQTT brokers, Modbus devices, SQL databases, REST APIs, whatever protocols you're running. Same natural language interface, same investigation capabilities, different underlying systems. The infrastructure you have becomes the infrastructure you can actually use. -For a complete guide to connecting PLCs via OPC UA, EtherNet/IP, Siemens S7, and Modbus to MQTT, cloud, and enterprise systems, see the [FlowFuse PLC integration overview](/landing/plc/). +For [what an OPC UA server actually exposes](/integrations/opcua/#what-is-opc-ua), and how FlowFuse connects to it as a client, see the FlowFuse OPC UA overview. For a complete guide to connecting PLCs via OPC UA, EtherNet/IP, Siemens S7, and Modbus to MQTT, cloud, and enterprise systems, see the [FlowFuse PLC integration overview](/landing/plc/). diff --git a/src/blog/2026/01/kepware-opcua-better-alternative.md b/src/blog/2026/01/kepware-opcua-better-alternative.md index f30051a7cf..6a91c42f72 100644 --- a/src/blog/2026/01/kepware-opcua-better-alternative.md +++ b/src/blog/2026/01/kepware-opcua-better-alternative.md @@ -115,4 +115,4 @@ Evaluate alternatives now from strength. Or negotiate renewals later from weakne Kepware won through early dominance and ecosystem lock-in. That's separate from being the right architecture for current operations. -See [how FlowFuse connects any PLC to MQTT, OPC UA, cloud, and enterprise systems](/landing/plc/), without per-tag licensing or proprietary lock-in. +See [OPC UA vs Kepware and other gateway products](/integrations/opcua/#opc-ua-vs-mqtt-modbus-kepware) for the comparison, or [how FlowFuse connects any PLC to MQTT, OPC UA, cloud, and enterprise systems](/landing/plc/), without per-tag licensing or proprietary lock-in. diff --git a/src/blog/2026/01/opcua-vs-mqtt.md b/src/blog/2026/01/opcua-vs-mqtt.md index b2d9cd2d09..9f1a258ce9 100644 --- a/src/blog/2026/01/opcua-vs-mqtt.md +++ b/src/blog/2026/01/opcua-vs-mqtt.md @@ -291,4 +291,4 @@ It's "MQTT where? OPC UA where? Both where?" Answer that based on your requirements, not vendor marketing. -For a practical guide to connecting PLCs via both OPC UA and MQTT in FlowFuse, alongside EtherNet/IP, Siemens S7, and Modbus, see the [FlowFuse PLC integration overview](/landing/plc/). +See the [OPC UA vs MQTT breakdown](/integrations/opcua/#opc-ua-vs-mqtt-modbus-kepware) on FlowFuse's OPC UA overview for the same comparison against Modbus and Kepware. For a practical guide to connecting PLCs via both OPC UA and MQTT in FlowFuse, alongside EtherNet/IP, Siemens S7, and Modbus, see the [FlowFuse PLC integration overview](/landing/plc/). diff --git a/src/blog/2026/03/why-opcua-is-not-replacing-modbus-yet.md b/src/blog/2026/03/why-opcua-is-not-replacing-modbus-yet.md index 6fa5d274fc..c9588c2027 100644 --- a/src/blog/2026/03/why-opcua-is-not-replacing-modbus-yet.md +++ b/src/blog/2026/03/why-opcua-is-not-replacing-modbus-yet.md @@ -111,7 +111,7 @@ This reflects how industrial modernization actually happens. Plants don't replac The business case is straightforward. Replacing field devices across a large facility to gain native OPC UA at the source costs millions of dollars, requires production downtime, and delivers no improvement in the process being controlled. Adding an edge gateway costs thousands, takes days to deploy, and delivers the same data quality improvement. The ROI calculation ends quickly. -FlowFuse is built around exactly this architecture. Node-RED flows running on the edge read Modbus registers from legacy field devices, apply context and normalization, and publish structured data over MQTT or OPC UA to cloud systems, historians, and analytics platforms. The Modbus equipment keeps running. The modern data infrastructure gets what it needs. The migration happens at the connectivity layer rather than the device layer, which is the only migration path that makes economic sense for most operational facilities. +FlowFuse is built around exactly this architecture. Node-RED flows running on the edge read Modbus registers from legacy field devices, apply context and normalization, and publish structured data over MQTT or OPC UA to cloud systems, historians, and analytics platforms. The Modbus equipment keeps running. The modern data infrastructure gets what it needs. The migration happens at the connectivity layer rather than the device layer, which is the only migration path that makes economic sense for most operational facilities. See [OPC UA vs Modbus](/integrations/opcua/#opc-ua-vs-mqtt-modbus-kepware) on the FlowFuse OPC UA overview for the same argument in comparison form. The gateway middle ground isn't a compromise born of failure. It's a pragmatic recognition that the automation stack has always been heterogeneous and always will be. New protocols don't replace old ones in industrial environments. They get added on top, and the translation layer between them becomes the most important piece of architecture in the building. diff --git a/src/blog/2026/05/opc-ua-security-attack-vectors.md b/src/blog/2026/05/opc-ua-security-attack-vectors.md index 87b4f61e0f..3122f09f9f 100644 --- a/src/blog/2026/05/opc-ua-security-attack-vectors.md +++ b/src/blog/2026/05/opc-ua-security-attack-vectors.md @@ -88,3 +88,5 @@ Integration servers, the gateways stitching multiple OPC UA systems together, ar The vulnerabilities threat actors exploit in OPC UA are rarely clever zero days. They're disabled trust lists, anonymous logins, stale ciphers, exposed servers, and trusted clients fed bad data. The protocol gives you the tools to close every one. The question is whether they're switched on. That's an architecture problem, and it's where we're headed next. In the follow-up, *How to Establish a Defensible OPC UA Security Architecture*, we'll turn these attack vectors into a concrete blueprint for building OPC UA deployments that hold up. + +See [why security isn't optional with OPC UA](/integrations/opcua/#opc-ua-security) for how FlowFuse's OPC UA client and server keep these openings closed by default. diff --git a/src/blog/2026/06/opc-ua-security-best-practices.md b/src/blog/2026/06/opc-ua-security-best-practices.md index 2cb68a8e89..f557f896b9 100644 --- a/src/blog/2026/06/opc-ua-security-best-practices.md +++ b/src/blog/2026/06/opc-ua-security-best-practices.md @@ -219,4 +219,4 @@ Every vector in Part 1 had the same root cause: a tool OPC UA handed you that no 7. **Stack and gateways patched.** 8. **Tested against the policy, not the assumption.** -OPC UA shipped with the strongest security model in industrial protocols. Part 1 showed what it looks like switched off. This is what it looks like switched on, and where FlowFuse fits is making it the default rather than the project: data pulled off exposed, internet-facing servers into a managed, segmented architecture where Reverse Connect, enforced trust, and least-privilege access are how the system is built, not a hardening pass you hope someone remembers to run. +OPC UA shipped with the strongest security model in industrial protocols. Part 1 showed what it looks like switched off. This is what it looks like switched on, and [where FlowFuse's OPC UA client and server fit](/integrations/opcua/#opc-ua-security) is making it the default rather than the project: data pulled off exposed, internet-facing servers into a managed, segmented architecture where Reverse Connect, enforced trust, and least-privilege access are how the system is built, not a hardening pass you hope someone remembers to run. diff --git a/src/blog/2026/06/opcua-to-influxdb.md b/src/blog/2026/06/opcua-to-influxdb.md index 616f67084c..58bfec891e 100644 --- a/src/blog/2026/06/opcua-to-influxdb.md +++ b/src/blog/2026/06/opcua-to-influxdb.md @@ -195,6 +195,6 @@ Storing data is only half the story. The InfluxDB In node lets you query reading ## Where to go from here -You now have a durable, queryable record of your equipment's behavior. From here you can read more tags, tag each reading with its machine or line so you can slice the data later, and build dashboards on top of InfluxDB to chart trends and spot the slow drift that real-time values hide. +You now have a durable, queryable record of your equipment's behavior. From here you can read more tags off the [OPC UA server](/integrations/opcua/#opc-ua-client-and-server-capabilities), tag each reading with its machine or line so you can slice the data later, and build dashboards on top of InfluxDB to chart trends and spot the slow drift that real-time values hide. The real payoff comes when you stop reacting to problems and start seeing them coming. A pump that's drawing a little more current each week, a tank that's taking longer to fill, a temperature that's creeping past its usual range, all of it now sits in a history you can query, instead of vanishing the moment it happens. diff --git a/src/landing/images/opcua-landing-image.png b/src/landing/images/opcua-landing-image.png new file mode 100644 index 0000000000..ff505ec703 Binary files /dev/null and b/src/landing/images/opcua-landing-image.png differ diff --git a/src/landing/opcua.njk b/src/landing/opcua.njk new file mode 100644 index 0000000000..ccdd0dda81 --- /dev/null +++ b/src/landing/opcua.njk @@ -0,0 +1,681 @@ +--- +metaTitle: "OPC UA Client & Server" +permalink: /integrations/opcua/ +layout: page +nohero: true +meta: + title: "OPC UA Client & Server | Certified Node | FlowFuse" + description: "Connect, secure, and bridge OPC UA with a FlowFuse Certified Node, then reach Modbus, EtherNet/IP, MQTT, and 5,000+ other integrations in the same flow." + keywords: "opc ua, opc, opc meaning, what does opc stand for, opc ua server, opc ua client, opc client, opc server, opc da vs opc ua, opc ua node-red, opc ua certified node, opc ua security, opc ua vs mqtt, opc ua vs modbus, opc ua historian, opc ua gateway, free opc ua client, uaexpert, kepware alternative, opc ua information model, opc ua subscriptions, opc ua alarms events, opc ua certificate management, opc ua reverse connect, unified namespace opc ua" + faq: + - question: "What is OPC UA, and what does OPC stand for?" + answer: > + OPC UA stands for "OPC Unified Architecture." OPC itself dates back to 1996 as "OLE for Process Control," and was later reinterpreted as "Open Platform Communications" once it outgrew Microsoft's OLE technology. OPC UA is the modern, platform-independent, service-oriented standard for exchanging data between industrial equipment, applications, and enterprise systems. It goes well beyond a simple point-to-point protocol: it defines a structured information model (an "address space" of nodes, types, and relationships), built-in security, and services for real-time subscriptions, historical access, alarms and events, and method calls. The OPC Foundation maintains it, and virtually every major automation vendor implements it. + - question: "What's the difference between an OPC UA client and an OPC UA server?" + answer: > + An OPC UA server exposes data as a browsable information model that other applications can connect to. That source might be a PLC, a historian, or a piece of software. An OPC UA client is the application that connects to a server to browse, read, write, and subscribe to that data. Many devices and platforms are both: a Siemens S7-1500 typically runs an OPC UA server, while a SCADA package typically runs as a client to consume it. + - question: "OPC UA vs OPC DA: what changed, and do I still need to care about OPC DA?" + answer: > + OPC DA (Data Access) is the original "OPC Classic" standard: a Windows-only, COM/DCOM-based protocol for reading and writing live process values, with no built-in security and no standardized information model. OPC UA replaced it with a platform-independent, secured, structured architecture that also adds historical access, alarms and events, and method calls, capabilities OPC DA never had. OPC DA still runs on a lot of legacy Windows-based SCADA and historian installs, so most real-world integration work involves bridging OPC DA sources into OPC UA (or MQTT) rather than choosing one from scratch. + - question: "Is there a free OPC UA client?" + answer: > + Yes, in a couple of forms. UaExpert, from Unified Automation, is a free (though closed-source) generic client for browsing a server's address space and testing connectivity, and it's a great first stop. Node-RED, which FlowFuse is built on, also has free, open-source community OPC UA client nodes such as node-red-contrib-opcua. Those take you beyond browsing, so you can build a production flow around what you find at no license cost. FlowFuse also offers a professionally maintained OPC UA Certified Node, built by Sterfive, as part of the FlowFuse Edge offering, for teams that want that node vetted and supported rather than self-maintained. + - question: "Is OPC UA a PLC, a protocol, or something else?" + answer: > + Neither, and it doesn't replace a PLC either. It's the layer that lets a PLC, a SCADA system, a historian, or an MES expose and exchange data in a common, structured, secured way. Many PLCs expose an OPC UA server alongside their own native protocol (S7comm, EtherNet/IP, and so on). If you're integrating directly with PLC hardware across multiple protocols rather than with OPC UA specifically, see the FlowFuse PLC integration. + - question: "Is OPC UA secure?" + answer: > + OPC UA builds security into the specification rather than bolting it on afterward: application authentication via X.509 certificates, user authentication, and message-level SignAndEncrypt for integrity and confidentiality. The problem in practice isn't the spec. Trust lists get left in "accept all" mode, self-signed certificates never get rotated, and Security Policy gets set to None for convenience during commissioning and never revisited. Our two-part guide covers both sides: how attackers actually exploit these gaps and how to build a defensible architecture with Reverse Connect, proper trust lists, and GDS-managed certificates. + - question: "OPC UA vs MQTT: which one should I use?" + answer: > + They solve different problems, so the question is usually a category error. OPC UA excels at structured, semantically rich, request/response and subscription-based access to a single source, with strong native security. MQTT excels at lightweight, many-to-many publish/subscribe distribution across a network, brokers, and a Unified Namespace. Most production architectures use both: OPC UA to pull structured data out of a PLC or historian, MQTT to distribute it broadly. Read the full breakdown in MQTT vs OPC UA: Why This Question Never Has a Straight Answer. + - question: "OPC UA vs Modbus: why hasn't OPC UA replaced it?" + answer: > + OPC UA is technically superior on almost every axis, security, data typing, discoverability, yet Modbus still ships on new field devices because it's simpler, cheaper to implement on constrained hardware, and universally supported without licensing or certificate overhead. See Why OPC UA Is Not Replacing Modbus (Yet) for the full technical and commercial breakdown, and what would actually have to change for that to shift. + - question: "Can FlowFuse act as both an OPC UA client and an OPC UA server?" + answer: > + Yes, with one restriction. FlowFuse can browse and read/write tags from any third-party OPC UA server as a client, on any deployment, cloud or self-hosted. Acting as a server, exposing FlowFuse's own information model for other OPC UA clients to consume, requires self-hosted FlowFuse. It isn't available on FlowFuse Cloud, since Cloud only exposes HTTP/HTTPS and an OPC UA server needs a raw TCP port. On self-hosted FlowFuse, client and server nodes share one certificate store, so a single deployment can pull data in from a PLC's server and simultaneously re-serve a curated, secured model upstream. + - question: "Do I need Kepware or another OPC UA gateway product?" + answer: > + Not necessarily. Kepware and similar products became the default when building an OPC UA server or client from scratch was hard, but per-tag pricing scales badly and recent ownership changes have made long-term cost and support less predictable. FlowFuse can connect to an existing Kepware server as a client on any deployment (see our Kepware connection guide), or replace it outright by building the OPC UA client or server directly in Node-RED, with server hosting requiring self-hosted FlowFuse. See Beyond Kepware: Why Modern Industrial Connectivity Demands a Second Look. + - question: "How do I get historical data out of an OPC UA server?" + answer: > + FlowFuse can poll or subscribe to OPC UA nodes and write timestamped values into a time-series database like InfluxDB or TimescaleDB. That gives you a durable, queryable history independent of the PLC's own limited historian buffer. Walk through the full setup in Historical Data Logging with OPC UA and InfluxDB. FlowFuse also supports OPC UA's native Historical Access (HA) service directly, for servers that already maintain their own history. + - question: "Can OPC UA data feed AI agents or an MCP server?" + answer: > + Yes. Because OPC UA already exposes a structured, browsable information model, it's a natural fit for agentic AI. Instead of an engineer manually browsing an address space to investigate a fault, an AI agent can query the model directly, correlate live values with alarms and history, and surface a root cause. See Agentic AI Reads OPC UA Servers So You Don't Have To for how this works with FlowFuse's MCP support. + - question: "Does FlowFuse work on-premises or in the cloud for OPC UA?" + answer: > + Both. Run FlowFuse on FlowFuse Cloud, self-managed on your own infrastructure, or on the FlowFuse Device Agent at the edge, right next to the OPC UA servers you're connecting to. Many teams run the OPC UA client or server on an industrial PC inside the plant network, then forward selected data outward over MQTT or a secured OPC UA Reverse Connect session. Nothing has to accept inbound connections from outside the plant. + - question: "Is FlowFuse's OPC UA support a certified node, or a community package?" + answer: > + Both are available. You can use free, open-source community OPC UA nodes in any FlowFuse deployment, the same packages you'd use in plain Node-RED. FlowFuse also offers a FlowFuse Certified Node for OPC UA, built on node-opcua and developed and maintained by Sterfive, the team behind that stack, delivered through the FlowFuse Edge Certified Nodes catalogue. FlowFuse vets certified nodes for quality, security, and support, and keeps them maintained on an ongoing basis, unlike community packages, which vary in quality and can go unmaintained without warning. See the OPC UA Certified Node documentation for the full capability set, contact us to enable it, or read about how FlowFuse Certified Nodes work. + - question: "Can FlowFuse bridge OPC UA with other industrial protocols in the same flow?" + answer: > + Yes. FlowFuse runs OPC UA alongside FlowFuse Certified Nodes for Modbus and EtherNet/IP (CIP), plus 5,000+ community nodes covering Siemens S7, PROFINET, BACnet, DNP3, Mitsubishi MC, Beckhoff ADS, and more, all in the same flow. Bridging an OPC UA server to a legacy Modbus device, or normalizing OPC UA and S7 data into one MQTT topic hierarchy, becomes a wire between two nodes on the same canvas rather than a separate integration project with its own gateway and license. +image: /landing/images/opcua-landing-image.png +capabilities: + - icon: "components/icons/cube-transparent.svg" + title: "Structured Information Model" + description: "Browse a real address space of objects, types, and relationships instead of a flat register list. Data arrives with context, not just a tag name and a number." + links: + - text: "Browse & explore the address space →" + url: "/node-red/flowfuse/edge/opcua/#12.-browse" + - icon: "components/icons/bolt.svg" + title: "Real-Time Subscriptions" + description: "Subscribe to nodes and get notified only when values change. No polling every tag on a fixed interval, no wasted controller scan budget." + links: + - text: "Monitor node reference →" + url: "/node-red/flowfuse/edge/opcua/#10.-monitor" + - icon: "components/icons/clock.svg" + title: "Historical Access & Logging" + description: "Read a server's native History (HA) service, or log live values into InfluxDB or TimescaleDB. Trends stay queryable long after the PLC buffer rolls over." + links: + - text: "History Read node reference →" + url: "/node-red/flowfuse/edge/opcua/#14.-history-read" + - icon: "components/icons/bell-alert.svg" + title: "Alarms & Events" + description: "Subscribe to condition-based alarms natively, filtered by type and severity on the server side. Stop polling fault bits and reconstructing state changes after the fact." + links: + - text: "Monitor Event node reference →" + url: "/node-red/flowfuse/edge/opcua/#11.-monitor-event" + - icon: "components/icons/shield-check.svg" + title: "Security Built Into the Spec" + description: "X.509 certificate authentication, user authentication, and SignAndEncrypt come with the standard. Reverse Connect covers servers that can't accept inbound sessions." + links: + - text: "Configure a secure connection →" + url: "/node-red/flowfuse/edge/opcua/#5.-configure-a-connection" + - icon: "components/icons/server-stack.svg" + title: "Client + Server, One Runtime" + description: "Read and write a third-party server as a client. On self-hosted FlowFuse, expose your own curated information model as a server, in the same flow." + links: + - text: "Hosting an OPC UA server →" + url: "/node-red/flowfuse/edge/opcua/#16.-hosting-an-opc-ua-server" +protocols: + - icon: "components/icons/arrows-pointing-out.svg" + title: "Modbus" + description: "TCP, UDP, and Serial (RTU/ASCII) in one long-term supported package. Read and write coils and registers, or simulate a server for testing." + linkText: "Modbus Certified Node →" + url: "/node-red/flowfuse/edge/modbus/" + - icon: "components/icons/chip.svg" + title: "EtherNet/IP (CIP)" + description: "Native Rockwell and Allen-Bradley connectivity: ControlLogix, CompactLogix, Micro800, SLC500, and other CIP-capable devices." + linkText: "CIP Suite Certified Node →" + url: "/node-red/flowfuse/edge/cip-suite/" + - icon: "components/icons/camera.svg" + title: "RTSP Video" + description: "Turn factory-floor camera feeds into images your flow can act on, alongside the sensor and PLC data flowing beside it." + linkText: "RTSP Certified Node →" + url: "/node-red/flowfuse/edge/rtsp/" + - icon: "components/icons/server-stack.svg" + title: "Siemens S7" + description: "Direct S7comm connectivity to S7-300, S7-400, S7-1200, and S7-1500 PLCs, for the many Siemens deployments that predate an OPC UA server." + linkText: "Siemens S7 integration guide →" + url: "/blog/2025/01/integrating-siemens-s7-plcs-with-node-red-guide/" + - icon: "components/icons/wifi.svg" + title: "MQTT" + description: "Publish OPC UA, Modbus, or S7 data to any MQTT broker in the same flow, normalized into a Unified Namespace topic hierarchy." + linkText: "Bridging OPC UA to MQTT →" + url: "/blog/2024/08/opc-ua-to-mqtt-with-node-red/" + - icon: "components/icons/squares-plus.svg" + title: "5,000+ Community Nodes" + description: "Beyond the certified set: PROFINET, BACnet, DNP3, IEC 61850, Mitsubishi MC Protocol, Omron FINS, Beckhoff TwinCAT ADS, and more." + linkText: "Browse the node library →" + url: "/integrations/" +comparisons: + - title: "OPC UA vs MQTT" + description: "Different jobs, not rivals. OPC UA pulls structured data out of a single source. MQTT distributes it many-to-many across a Unified Namespace. Most plants run both." + linkText: "Read the full comparison →" + url: "/blog/2026/01/opcua-vs-mqtt/" + - title: "OPC UA vs Modbus" + description: "OPC UA wins on security, data typing, and discoverability. Modbus still ships on new field devices because it's cheap, simple, and universal." + linkText: "Why Modbus survives →" + url: "/blog/2026/03/why-opcua-is-not-replacing-modbus-yet/" + - title: "OPC UA vs OPC DA" + description: "OPC DA is the Windows-only COM/DCOM original, with no built-in security and no information model. Most teams bridge DA into UA rather than choose between them." + linkText: "Bridge a legacy OPC server →" + url: "/blog/2024/02/connect-node-red-to-kepware-opc/" + - title: "FlowFuse vs Kepware" + description: "Per-tag pricing scales badly, and ownership changes make long-term cost harder to predict. Connect to your existing Kepware server, or replace it outright." + linkText: "Beyond Kepware →" + url: "/blog/2026/01/kepware-opcua-better-alternative/" +useCases: + - icon: "components/icons/clock.svg" + title: "Historical Data Logging" + description: "Subscribe to OPC UA nodes and write timestamped values into InfluxDB or TimescaleDB, for a durable history that outlives the server's own buffer." + linkText: "OPC UA to InfluxDB guide →" + url: "/blog/2026/06/opcua-to-influxdb/" + - icon: "components/icons/computer-desktop.svg" + title: "OPC UA Client Dashboards" + description: "Browse an address space, read and write values, subscribe to alarms, then wire the results straight into a live operator dashboard. No separate client, no separate HMI license." + linkText: "Build an OPC UA client dashboard →" + url: "/blog/2023/07/how-to-build-a-opc-client-dashboard-in-node-red/" + - icon: "components/icons/wifi.svg" + title: "Bridging OPC UA to MQTT / UNS" + description: "Pull structured data out of an OPC UA server and republish it to any MQTT broker, normalized into a Unified Namespace topic hierarchy on the way." + linkText: "Bridging OPC UA to MQTT →" + url: "/blog/2024/08/opc-ua-to-mqtt-with-node-red/" + - icon: "components/icons/cog.svg" + title: "Agentic AI on OPC UA Data" + description: "Let an AI agent query the information model directly, correlating live values, alarms, and history to surface a root cause instead of a manual address-space search." + linkText: "Agentic AI reads OPC UA servers →" + url: "/blog/2026/01/eliminate-opc-ua-bottleneck-ai-agents/" + - icon: "components/icons/link.svg" + title: "Migrating Off Kepware" + description: "Connect to an existing KepServerEX server as a client today, no rip-and-replace. Retire it on your own timeline by hosting an equivalent server on self-hosted FlowFuse." + linkText: "Connect to a Kepware OPC server →" + url: "/blog/2024/02/connect-node-red-to-kepware-opc/" + - icon: "components/icons/server-stack.svg" + title: "Hosting Your Own OPC UA Server" + description: "Model your own address space and expose it as a standards-compliant server, so any SCADA, historian, or other client can browse and subscribe to it. Requires self-hosted FlowFuse: Cloud exposes HTTP/HTTPS only, and a server needs a raw TCP port." + linkText: "Deploy a basic OPC UA server →" + url: "/blog/2023/07/how-to-deploy-a-basic-opc-ua-server-in-node-red/" +steps: + - number: "1" + title: "Connect or Build" + description: "Browse and connect to an existing OPC UA server as a client. On self-hosted FlowFuse, model your own address space and expose it as a server, from the same canvas." + - number: "2" + title: "Secure the Session" + description: "Set Security Policy to SignAndEncrypt, configure certificate trust lists, and use Reverse Connect where the server can't accept inbound sessions." + - number: "3" + title: "Bridge Other Protocols" + description: "Wire in Modbus, EtherNet/IP, or Siemens S7 nodes alongside OPC UA in the same flow, for the plants that aren't running OPC UA end to end." + - number: "4" + title: "Visualize, Route & Scale" + description: "Wire the results into a live dashboard, forward data to MQTT, a time-series database, or a cloud platform. Then push the flow to one edge device or a thousand with one click." +resourceGroups: + - group: "Start here" + items: + - title: "OPC UA Tutorial: Connect and Exchange Data with Industrial Equipment" + image: "./blog/2025/07/images/opcua-tutorial.png" + alt: "Reading and writing PLC tags over OPC UA in a Node-RED flow" + url: "/blog/2025/07/reading-and-writing-plc-data-using-opc-ua/" + - title: "OPC UA Tutorial: Advanced Monitoring with Subscriptions, Alarms & History" + image: "./blog/2025/08/images/advanced-opcua-real-time-subscriptions-alarms-historical-data.png" + alt: "Subscriptions, alarms, and historical reads in an OPC UA flow" + url: "/blog/2025/08/advanced-opcua-real-time-subscriptions-alarms-historical-data/" + - title: "How to Deploy a Basic OPC UA Server in Node-RED" + image: "./blog/2023/07/images/opc-ua-1/opc-ua-1-title-image.png" + alt: "An OPC UA server running inside a Node-RED flow" + url: "/blog/2023/07/how-to-deploy-a-basic-opc-ua-server-in-node-red/" + - group: "Secure it" + items: + - title: "OPC UA Security: How Threat Actors Exploit Industrial Protocol Vulnerabilities" + image: "./blog/2026/05/images/opcua-security-blog.png" + alt: "Common OPC UA misconfigurations that attackers target" + url: "/blog/2026/05/opc-ua-security-attack-vectors/" + - title: "OPC UA Security: How to Establish a Defensible Architecture" + image: "./blog/2026/06/images/opc-ua-security.png" + alt: "A defensible OPC UA architecture with Reverse Connect and managed certificates" + url: "/blog/2026/06/opc-ua-security-best-practices/" + - group: "Compare and migrate" + items: + - title: "MQTT vs OPC UA: Why This Question Never Has a Straight Answer" + image: "./blog/2026/01/images/opcua-vs-mqtt.png" + alt: "Where MQTT and OPC UA each fit in an industrial architecture" + url: "/blog/2026/01/opcua-vs-mqtt/" + - title: "Why OPC UA Is Not Replacing Modbus (Yet)" + image: "./blog/2026/03/images/opcua-is-not-replacing-modbus-yet.png" + alt: "Why Modbus still ships on new field devices" + url: "/blog/2026/03/why-opcua-is-not-replacing-modbus-yet/" + - title: "Beyond Kepware: Why Modern Industrial Connectivity Demands a Second Look" + image: "./blog/2026/01/images/kepware-alternative.png" + alt: "Alternatives to per-tag OPC UA gateway licensing" + url: "/blog/2026/01/kepware-opcua-better-alternative/" + - group: "Put the data to work" + items: + - title: "Historical Data Logging with OPC UA and InfluxDB" + image: "./blog/2026/06/images/opcua-to-influxdb.png" + alt: "Logging OPC UA values into an InfluxDB time-series database" + url: "/blog/2026/06/opcua-to-influxdb/" + - title: "Connect Node-RED to KepServerEX OPC Server" + image: "./blog/2024/02/images/node-red-to-kepware.png" + alt: "A Node-RED client session against a KepServerEX OPC UA server" + url: "/blog/2024/02/connect-node-red-to-kepware-opc/" +webinars: + - title: "MQTT vs OPC UA: The Industrial Data Showdown" + image: "./images/webinars/webinar-mqtt-vs-opc-ua.jpg" + alt: "MQTT vs OPC UA industrial data showdown webinar" + url: "/webinars/2026/mqtt-vs-opc-ua-industrial-data-showdown/" + - title: "Making Industry Work – Leveraging OPC UA at Scale" + image: "./images/webinars/making-industry-work-leveraging-opc-ua-at-scale.jpg" + alt: "Leveraging OPC UA at scale webinar" + url: "/webinars/2026/making-industry-work-leveraging-opc-ua-at-scale/" + - title: "Simplifying OPC UA: Implement Scalable Information Models with FlowFuse" + image: "./images/webinars/simplifying-opc-ua.jpg" + alt: "Simplifying OPC UA webinar" + url: "/webinars/2025/simplifying-opc-ua/" + - title: "Getting Started with OPC-UA and Node-RED" + image: "./images/webinars/getting-started-with-opc-ua-and-node-red-webinar-august.jpg" + alt: "Getting started with OPC-UA and Node-RED webinar" + url: "/webinars/2023/getting-started-opcua-node-red/" +enterprise: + heading: 'Built for Enterprise OPC UA Deployments' + description: "FlowFuse is SOC 2 Type I and Type II certified, with role-based access control, single sign-on, audit logging, and air-gapped, self-hosted deployment options, for teams running OPC UA clients and servers across regulated or security-sensitive plants." + badge: "components/icons/soc-2-badge.svg" + badgeLabel: "SOC 2 Type II" + items: + - icon: "components/icons/single-sign-on.svg" + label: "Single Sign-On" + - icon: "components/icons/audit-logs.svg" + label: "Audit Logs" + - icon: "components/icons/role-based-access.svg" + label: "Role-Based Access Control" + - icon: "components/icons/air-gapped-deployment.svg" + label: "Air-Gapped / Self-Hosted Deployment" + linkText: "Review our security and compliance details" + linkHref: "/platform/security/" +--- + +
+ + +
+
+
+
+

+ OPC UA Client and Server +

+

+ Using the FlowFuse Certified Node for OPC UA, connect to any OPC UA server as a client, or host your own server on self-hosted FlowFuse. Bridge structured, secured industrial data to Modbus, EtherNet/IP, MQTT, historians, and the cloud, all in the same flow. +

+
+ BOOK A DEMO + GET STARTED NOW +
+
+
+
+ {% image "./images/opcua-landing-image.png", "Industrial engineer building an OPC UA flow with FlowFuse on a laptop", [496] %} +
+
+
+
+
+ + +
+
+ +
+

What is OPC UA?

+
+ +
+
+

+ OPC UA stands for OPC Unified Architecture. OPC started life in 1996 as "OLE for Process Control," and later became "Open Platform Communications" once it moved beyond Microsoft's original OLE technology. +

+

+ It isn't hardware, and it isn't a controller. It's a platform-independent, service-oriented specification for how data gets modeled, secured, and exchanged between an OPC UA server (the source exposing data) and an OPC UA client (the application consuming it). +

+

+ Where a protocol like Modbus moves raw register values, OPC UA exposes a structured information model: an address space of typed objects and relationships, plus built-in services for subscriptions, historical access, alarms and events, and method calls. +

+

+ Many PLCs expose an OPC UA server alongside their native protocol. If you're integrating directly with PLC hardware across multiple protocols, the FlowFuse PLC integration covers that. This page is about OPC UA itself: building clients and servers, securing them properly, and getting structured data where it needs to go. +

+
+ +
+
+

OPC UA core services

+
    +
  • Address Space: structured, browsable information model
    • +
  • Subscriptions: real-time, change-based updates
    • +
  • Historical Access (HA): native access to logged history
    • +
  • Alarms & Events (A&E): condition-based notifications
    • +
  • Method Calls: invoke server-side logic remotely
    • +
  • Security: certificates, authentication, SignAndEncrypt
    • +
+
+
+

Where OPC UA shows up

+
    +
  • Native servers on Siemens S7-1500, Omron, Beckhoff
    • +
  • Rockwell/Allen-Bradley, via FactoryTalk Linx Gateway or a third-party server
    • +
  • SCADA and historian data exchange
    • +
  • Kepware and other OPC UA gateway products
    • +
  • MES and enterprise system integration
    • +
  • Unified Namespace, as the source of structured data
    • +
+
+
+
+ + +
+
+

+ OPC UA's power gets left on the table. +

+

+ Building an OPC UA client or server from scratch means wrestling with an SDK. Most teams route around that by paying per-tag for a gateway product instead. Either way, security ends up as whatever the vendor tool defaults to, not a deliberate choice. FlowFuse gives you a low-code runtime that does both client and server properly, with security you actually configure. +

+
+
+ +
+
+ + +
+
+ + +
+

Backed by a FlowFuse Certified Node

+
+ +
+

+ FlowFuse connects to OPC UA through a FlowFuse Certified Node, vetted against three standing pillars: quality, security, and support. Quality means tested, reliable, and compatible. Security means proactive vulnerability handling, with certification revoked and customers notified if it falls short. All three get maintained on an ongoing basis. +

+

+ The OPC UA certified node builds on node-opcua, the open-source OPC UA stack used across the industry. Sterfive develops and maintains it, the same team behind node-opcua itself, rather than a generalist contractor bolting on protocol support. The people maintaining your OPC UA connection are the people who maintain the stack it runs on. +

+

+ One node handles both directions: connect to third-party OPC UA servers as a client, or host your own server on self-hosted FlowFuse. Both sides share a single certificate store, so a trust decision made for one applies to the other. Server hosting isn't available on FlowFuse Cloud. The node ships through the FlowFuse Edge Certified Nodes catalogue, contact us to enable it for your instance. +

+
+
+ View the OPC UA Certified Node Docs → + How FlowFuse Certified Nodes work → +
+ + +
+
+

Core OPC UA capabilities in FlowFuse

+

+ FlowFuse supports OPC UA through dedicated client and server nodes, making it easy to connect OPC UA systems to your industrial applications. +

+
+ +
+ {% for capability in capabilities %} +
+
+ {% include capability.icon %} +
+

{{ capability.title }}

+

{{ capability.description }}

+ {% for link in capability.links %} + {{ link.text }} + {% endfor %} +
+ {% endfor %} +
+
+ +
+
+ + +
+
+ +
+

OPC UA is one protocol. FlowFuse bridges all of them.

+

+ Real plants are never one protocol. OPC UA on the new line, Modbus on the legacy skid, EtherNet/IP on the Allen-Bradley cell, a camera feed nobody's touched since commissioning. FlowFuse runs them all in the same flow, so bridging data between them is a wire between nodes rather than a separate integration project. +

+
+ +
+ {% for protocol in protocols %} +
+
+ {% include protocol.icon %} +
+
+

{{ protocol.title }}

+

{{ protocol.description }}

+ {{ protocol.linkText }} +
+
+ {% endfor %} +
+ +

+ Modbus, EtherNet/IP, and RTSP ship as FlowFuse Certified Nodes through the FlowFuse Edge catalogue. Everything else is a free, open-source community node or built into core Node-RED. +

+ +
+
+ + +
+
+ +
+

Lock down OPC UA security, don't leave it optional

+

+ Most OPC UA breaches in the field don't come from broken cryptography. They come from security that was configured once during commissioning and never switched on. FlowFuse makes the secure path the easy path. +

+
+ +
+
+
+ {% include "components/icons/shield-exclamation.svg" %} +
+

How attackers get in

+

Disabled trust lists, self-signed certificates that never rotate, and Security Policy left at None since commissioning. These are the openings threat actors actually use, not cryptographic flaws in the standard.

+ Read: how threat actors exploit OPC UA → +
+
+
+ {% include "components/icons/shield-check.svg" %} +
+

A defensible architecture

+

Reverse Connect for servers that can't accept inbound sessions, GDS-managed certificate lifecycles, SignAndEncrypt as the default, and role-based access. A checklist turned into working configuration.

+ Read: building a defensible OPC UA architecture → +
+
+ +
+
+ + +
+
+
+

{{ enterprise.heading | safe }}

+

{{ enterprise.description }}

+ + {{ enterprise.linkText }} + {% include "components/icons/arrow-long-right.svg" %} + +
+
+
+
+ {% include enterprise.badge %} +
+

{{ enterprise.badgeLabel }}

+
+ {% for item in enterprise.items %} +
+
+ {% include item.icon %} +
+

{{ item.label }}

+
+ {% endfor %} +
+
+
+ + +
+
+ +
+

How does OPC UA compare?

+

+ OPC UA gets compared to other protocols and products constantly, usually without enough nuance. Here's the honest version of each. +

+
+ +
+ {% for item in comparisons %} +
+

{{ item.title }}

+

{{ item.description }}

+ {{ item.linkText }} +
+ {% endfor %} +
+ +
+
+ + +
+
+ +
+

What you can build with OPC UA + FlowFuse

+
+ +
+ {% for useCase in useCases %} +
+
+ {% include useCase.icon %} +
+
+

{{ useCase.title }}

+

{{ useCase.description }}

+ {{ useCase.linkText }} +
+
+ {% endfor %} +
+ +
+
+ + +
+
+ +
+

From OPC UA to insight, step by step

+
+ +
    + {% for step in steps %} +
  1. + Step {{ step.number }} +

    {{ step.title }}

    +

    {{ step.description }}

    +
    2. + {% endfor %} +
+ +
+
+ + +
+
+

+ Frequently asked questions +

+ {% include "faq.njk" %} +
+
+ + +
+
+ +
+

OPC UA guides and webinars

+
+ + {% for group in resourceGroups %} +
+

{{ group.group }}

+
+ {% for resource in group.items %} + +
  • +
    + {% image resource.image, resource.alt, [208] %} +
    + +
    • +     + {% endfor %} +
    +
    + {% endfor %} + +
    +

    Webinars

    +
    + {% for webinar in webinars %} + +
  • +
    + {% image webinar.image, webinar.alt, [208] %} +
    + +
    • +     + {% endfor %} +
    +
    + +
    + See all OPC UA articles → + See all webinars → +
    + +
    +
    + + +
    +
    +
    +

    Ready to build an OPC UA client or server the right way?

    +

    + No per-tag licensing. No Security Policy left at None. Connect to any OPC UA server, host your own, and bridge both to Modbus, MQTT, or a historian in the same flow. See it live, or start free.

    +
    + Book a Demo + Get Started Free +
    +
    +
    +
    + +