Connecting OPC Classic across two machines on different networks is notoriously painful because of DCOM. An OPC tunnel is the standard fix - it replaces DCOM with a simple, firewall-friendly connection.
OPC Tunnel in one line: An OPC tunnel is a pair of software agents that carry OPC data between two computers over a single TCP connection instead of Microsoft DCOM. One agent acts as an OPC client to the local server; the other presents a local OPC server to the remote client. Between them they use their own protocol, which passes cleanly through firewalls, works across domains, and recovers automatically from network drops.
OPC Classic (OPC DA, HDA, and A&E) is built on Microsoft COM/DCOM. That is fine when the OPC client and server run on the same machine, but connecting them across a network exposes DCOM's problems: it negotiates dynamic port numbers that firewalls block, it depends on matching Windows security and domain settings, and it can hang for minutes when a connection is lost because of long DCOM timeouts.
These issues make direct DCOM connections between plant and remote sites fragile and hard to secure. Opening the wide port ranges DCOM needs is also a security concern. Tunneling exists specifically to eliminate DCOM from the network path.
A tunnel uses two components. On the server-side machine, a tunnel agent runs as a local OPC client - it talks to the OPC server over local COM, which needs no network security. On the client-side machine, the partner agent presents itself as a local OPC server to the real client application. Again, that connection is local COM.
The two agents then communicate with each other over a single, defined TCP port using their own efficient protocol, often with TLS encryption. Because only one known port crosses the network, firewall rules are simple. The tunnel also detects a dropped link quickly and re-establishes it, and it reports a clear bad-quality status to the client instead of leaving it hung - a major reliability improvement over raw DCOM.
Many oil and gas facilities still run OPC Classic servers embedded in older DCS and SCADA products. When operators want to pull that data to a central control room, a corporate historian, or a cloud platform, they rarely can - or should - open DCOM across the WAN. A tunnel bridges the plant OPC server to the destination over one encrypted TCP connection.
Tunnels are also used to cross the OT/IT boundary. Placing the two agents on either side of a firewalled DMZ means the only thing traversing the boundary is a single authenticated, encrypted stream, which security teams can inspect and control. This is far more defensible than the sprawling DCOM permissions a direct connection would require.
Where possible, new integrations skip this entirely by using OPC UA, which is designed for secure networked communication and needs no tunnel. But because so much installed equipment is OPC Classic, tunneling remains a common and practical tool on brownfield sites.
No. OPC UA was designed for secure networked communication over a single configurable port with built-in authentication and encryption, so it does not use DCOM and needs no tunnel. Tunneling is specifically a workaround for OPC Classic's DCOM dependency.
Most tunneling products offer TLS encryption on the connection between the two agents. This is another advantage over raw DCOM, which offers weak and awkward security across networks.
Unlike DCOM, which can hang for minutes, a tunnel detects the drop quickly, flags the affected items as bad quality to the client, and automatically reconnects when the link returns - so the client application recovers cleanly.
This page references the protocol specifications published by the organizations below. Editions, product capabilities, and documentation change over time - confirm current requirements and specifications directly with the source.
Last reviewed: July 27, 2026. Merobix is not affiliated with, endorsed by, or sponsored by these organizations; their names are used only to identify the standards and products discussed.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.