# OPC-UA connection on VPN **URL:** \ **Category:** Ignition\ **Created:** [January 27, 2015, 11:06am UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604 "2015-01-27T11:06:14Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![xion8x8](https://avatars.discourse-cdn.com/v4/letter/x/cc9497/32.png) [@xion8x8](https://forum.inductiveautomation.com/u/xion8x8)\ **Post date:** [January 27, 2015, 11:06am UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/1 "2015-01-27T11:06:14Z")
I trying to use Ignition to connect an OPC-UA server from a remote site through VPN but it is faulted with “java.net.ConnectionException: Connection refused: connect” message on the OPC connections status. I have configured the OPC-UA connection like usual but it is not working. Hope someone can help or guide me to the correct way. I have attached the network architecture. ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/5/58384f9ec07151dea7358b6283258e8366e1e680.png) ---
**Author:** ![diat150](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diat150](https://forum.inductiveautomation.com/u/diat150)\ **Post date:** [January 27, 2015, 2:20pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/2 "2015-01-27T14:20:06Z")
dumb question but can you ping the server hosting kepware? is port 49320 open across both firewalls? may help to post screenshots of your opc-us config from the ignition webpage. also a screenshot showing your kepware opc-ua config would be helpful. ---
**Author:** ![xion8x8](https://avatars.discourse-cdn.com/v4/letter/x/cc9497/32.png) [@xion8x8](https://forum.inductiveautomation.com/u/xion8x8)\ **Post date:** [January 27, 2015, 2:35pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/3 "2015-01-27T14:35:04Z")
I can ping the both host and client. Firewall allow all ports. Settings on Ignition OPC UA connection and kepware UA configuration are the default one. Will attached screenshot tomorrow. ---
**Author:** ![diat150](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diat150](https://forum.inductiveautomation.com/u/diat150)\ **Post date:** [January 27, 2015, 3:04pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/4 "2015-01-27T15:04:30Z")
yeah take some screenshots of both configs. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 27, 2015, 3:42pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/5 "2015-01-27T15:42:06Z")
You probably need to use the endpoint override setting when configuring the UA connection in Ignition. Use the external IP address you’re using to connect to Kepware. ---
**Author:** ![xion8x8](https://avatars.discourse-cdn.com/v4/letter/x/cc9497/32.png) [@xion8x8](https://forum.inductiveautomation.com/u/xion8x8)\ **Post date:** [January 28, 2015, 12:10am UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/6 "2015-01-28T00:10:24Z")
Possible to give an example what should i insert into the host override in the advance setting? Thank you. ---
**Author:** ![xion8x8](https://avatars.discourse-cdn.com/v4/letter/x/cc9497/32.png) [@xion8x8](https://forum.inductiveautomation.com/u/xion8x8)\ **Post date:** [January 28, 2015, 3:57am UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/7 "2015-01-28T03:57:10Z")
Please find config screenshot below ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/9/9b258726fb93b9ddb3b361daba3b778bc7a2a63e.png) ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/d/d71c8b439b13a1128961b81a2a4fbe8b11e905f2.png) ---
**Author:** ![diat150](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diat150](https://forum.inductiveautomation.com/u/diat150)\ **Post date:** [January 28, 2015, 12:14pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/8 "2015-01-28T12:14:02Z")
if you go to the trusted client section in kepware do you see the ignition client? it should give you an option to accept the connection if so. one thing you can do is edit both of your urls on kepware and check off none on the security policies(make sure and reinitialize kepware after making this change). also change both security policy and message mode in ignition to none and see if it connets then. then you would know if it is something related to the encryption/security. you can also download uaexpert [unified-automation.com/produ … xpert.html](http://www.unified-automation.com/products/development-tools/uaexpert.html) to help troubleshoot. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 28, 2015, 2:55pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/9 "2015-01-28T14:55:35Z")
If you check the “Show Advanced Properties?” checkbox there will be an endpoint address override property that you’ll put 192.168.201.101 into as well. diat150’s advice will also have to be done as well. As soon as Ignition is actually able to make a connection its client certificate will show up in Kepware and has to be marked as trusted. ---
**Author:** ![xion8x8](https://avatars.discourse-cdn.com/v4/letter/x/cc9497/32.png) [@xion8x8](https://forum.inductiveautomation.com/u/xion8x8)\ **Post date:** [January 29, 2015, 2:49pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/10 "2015-01-29T14:49:10Z")
Thanks all for the guide, it works after i used the host override. ---
**Author:** ![HooK\_a](https://avatars.discourse-cdn.com/v4/letter/h/87869e/32.png) [@HooK\_a](https://forum.inductiveautomation.com/u/HooK_a)\ **Post date:** [July 19, 2016, 11:56am UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/11 "2016-07-19T11:56:32Z")
I have a similar problem, but we must override the host address and the port number. Pls, check the scheme. I have Modem Gateway to which are connected the several remote modem. At the Gateway created several connection that forwarding local network traffic to the remote station on the specified port. I set up the following connection to the remote OPC UA server: Host: 192.168.1.30 Port: 62000 Security Policy: None Message Security Mode: None Host Override: 192.168.127.200 (also tried the OPC UA server name WIN-EIECJ39OV0I) Connection is faulted. Here is wrapper log: ```auto DEBUG [ConnectionUtil] [09:41:26,183]: Getting endpoints from "opc.tcp://192.168.1.30:62000" DEBUG [ConnectionUtil] [09:41:28,230]: Received endpoint: opc.tcp://WIN-EIECJ39OV0I:4845 - [SignAndEncrypt:Basic128Rsa15:http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary] DEBUG [ConnectionUtil] [09:41:28,231]: Received endpoint: opc.tcp://WIN-EIECJ39OV0I:4845 - [None:None:http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary] DEBUG [ConnectionUtil] [09:41:28,231]: Selected endpoint: opc.tcp://WIN-EIECJ39OV0I:4845 - [None:None:http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary] ERROR [OpcUaConnection[ServerUA] ] [09:41:28,232]: Error connecting to server: StatusCode[Severity=Bad, Subcode=Bad_ConnectionRejected] ``` What can be done other than specifying the same port number on the Gateway and on the OPC UA server ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 19, 2016, 1:33pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/12 "2016-07-19T13:33:22Z")
HooK’a, it looks like you’ve got a network topology that the current connection settings can’t handle. I think the best we can do is modify the host override setting to also allow you to specify a port if necessary. This would be done for the 7.8.4 release. ---
**Author:** ![HooK\_a](https://avatars.discourse-cdn.com/v4/letter/h/87869e/32.png) [@HooK\_a](https://forum.inductiveautomation.com/u/HooK_a)\ **Post date:** [July 20, 2016, 6:12am UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-on-vpn/9604/13 "2016-07-20T06:12:48Z")
[quote=“Kevin.Herron”]HooK’a, it looks like you’ve got a network topology that the current connection settings can’t handle. I think the best we can do is modify the host override setting to also allow you to specify a port if necessary. This would be done for the 7.8.4 release.[/quote] Kevin.Herron, Could you add this feature in 7.7.x ?