# Unable to connect to OPC server - ignition in docker container **URL:** \ **Category:** Ignition\ **Tags:** ignition80\ **Created:** [March 5, 2021, 1:51pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150 "2021-03-05T13:51:41Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 1:51pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/1 "2021-03-05T13:51:41Z")
I’m having issues trying to set up an OPC Connection. I have Ignition 8.1.2 running on Linux Mint 20 in a docker container. I have port 55105 exposed. The OPC server is Siemens SimaticNET OPC Server V16 - S7OPT on port 55105 running on a VirtualBox VM on the same host as the docker container. ```auto $ docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES e1d5cf8f36a4 kcollins/ignition:8.1.2 "tini -g -- /usr/loc…" 3 seconds ago Up 2 seconds (health: starting) 8000/tcp, 8043/tcp, 0.0.0.0:8088->8088/tcp, 8060/tcp, 0.0.0.0:55105->55105/tcp compose_gateway_1 b2ed66907495 postgres:13.1 "docker-entrypoint.s…" 2 hours ago Up 2 seconds 0.0.0.0:5432->5432/tcp compose_db_1 ``` for some reason the OPC server won’t respond to the endpoint URL. It seems like the discovery URL is responding though. ![Screenshot from 2021-03-05 16-04-14](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/f/2f8535d0daa78b7f909187ca158fd9c124353afc.png) ![Screenshot from 2021-03-05 16-05-04](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/7/e7268be296fbd9d77743567c9c893c029a8fc18a.png) ![Screenshot from 2021-03-05 16-05-24](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/9/7973486a65d01176134962aa270d0aaa93c460ed.png) ![Screenshot from 2021-03-05 16-05-49](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/5/459b886c6c592e41cde7edac3427c984f4c84c01.png) I tried to use the substitute URL but the resulting endpoints are not correct. They are using port 4840 instead of 55105 and the security policies are not matching what’s configured on the server. Any ideas? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 5, 2021, 1:57pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/2 "2021-03-05T13:57:14Z")
What do the final settings look like if you edit and skip to advanced? > [@iamthebull](#): > > I tried to use the substitute URL but the resulting endpoints are not correct. They are using port 4840 instead of 55105 and the security policies are not matching what’s configured on the server. The server returns those endpoints you see in the final screenshot, what you see in that list is not influenced by any substitutions or changes you make to the discovery URL. ---
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 2:39pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/3 "2021-03-05T14:39:58Z")
![Screenshot from 2021-03-05 16-06-52](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/d/bdbb4187647a01189ad58ffb6a6d75f07e0c9d06.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 5, 2021, 2:42pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/4 "2021-03-05T14:42:28Z")
Try setting the “Host Override” to “10.0.1.156:55105”? What doesn’t work about the current configuration? ---
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 2:51pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/5 "2021-03-05T14:51:02Z")
> [@Kevin.Herron](#): > > What doesn’t work about the current configuration? UaException: status=Bad\_SecurityChecksFailed, message=An error occurred verifying security. at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.onError(UascClientAcknowledgeHandler.java:258) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.decode(UascClientAcknowledgeHandler.java:167) at io.netty.handler.codec.ByteToMessageCodec$1.decode(ByteToMessageCodec.java:42) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:498) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:437) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276) at io.netty.handler.codec.ByteToMessageCodec.channelRead(ByteToMessageCodec.java:103) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355) at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363) at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:714) at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:650) at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:576) at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493) at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989) at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) at java.base/java.lang.Thread.run(Unknown Source) 8.1.2 (b2021020311) Azul Systems, Inc. 11.0.9 ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 5, 2021, 2:52pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/6 "2021-03-05T14:52:40Z")
Ok, that means you’re able to connect but the server is closing it down with Bad\_SecurityChecksFailed. Usually this means you need to go figure out how to mark the Ignition client certificate as trusted in the server’s configuration. You will also have to do the same in the Ignition gateway under OPC UA \> Security \> Client tab for the server’s certificate ---
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 3:19pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/7 "2021-03-05T15:19:47Z")
Usually once a client tries connecting to the OPC server I see that client in the server config application and can mark that certificate as trusted. But that’s not happening. And all of this config stuff is behaving weirdly. I think it’s a networking issue with the container. I’ve set up connections to this OPC server several times before and have never seen anything like this. This is the first time attempting from a container though. ---
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 3:22pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/8 "2021-03-05T15:22:20Z")
If I try using 10.0.1.156:55105 in the initial endpoint URL box it times out. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 5, 2021, 4:46pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/9 "2021-03-05T16:46:55Z")
Not sure where port 55105 is coming from then because your server sure is responding on 4840 right now. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 5, 2021, 4:47pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/10 "2021-03-05T16:47:40Z")
> [@iamthebull](#): > > UaException: status=Bad\_SecurityChecksFailed, message=An error occurred verifying security. > at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.onError(UascClientAcknowledgeHandler.java:258) Getting this message means you are definitely connecting to _something_ before it rejects you for security reasons. ---
**Author:** ![kcollins](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcollins/32/19646_2.png) [@kcollins](https://forum.inductiveautomation.com/u/kcollins)\ **Post date:** [March 5, 2021, 5:00pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/11 "2021-03-05T17:00:17Z")
> [@iamthebull](#): > > I have port 55105 exposed. One thing I'll mention here is that there should not be a need to publish port 55105 on the Ignition container--you don't need to do that in order to make that outbound connection to the Windows VM running SimaticNET. Are both of these VM's using a bridged-mode network configuration? The default is usually a NAT configuration, and for VirtualBox I believe this means machines end up on a `192.168.56.0/24` network. But alas, you're connecting to something... ---
**Author:** ![kcollins](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcollins/32/19646_2.png) [@kcollins](https://forum.inductiveautomation.com/u/kcollins)\ **Post date:** [March 5, 2021, 5:13pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/12 "2021-03-05T17:13:26Z")
Also, another thing I’ll mention is that you could also adjust your compose definition to use host networking if you want to help eliminate the extra jump from the container network being created, though it _should_ be able to work this way as long as your Linux Mint host can hit that other VM… (with this, you’d not need to publish any ports) ---
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 6:04pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/13 "2021-03-05T18:04:17Z")
Port 55105 is the port it should be connecting on. ![Screenshot from 2021-03-05 21-03-08](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/2/32d58c3b48771f1582c8d2daceb6b1d5cdc91d94.png) ---
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 6:05pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/14 "2021-03-05T18:05:42Z")
I’m using a host only network 10.0.1.128/25. All other network operations are fine. And yes, it is connecting to something. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 5, 2021, 6:07pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/15 "2021-03-05T18:07:34Z")
Are you sure by checking the box you’re actually using 55105 and not the OPC UA default of 4840? ---
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 6:10pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/16 "2021-03-05T18:10:51Z")
Yes. From another client (OPC Scout) ![Screenshot from 2021-03-05 21-08-32](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/1/61265efc0b2557d53e3508b4031e7ff4d95d11cb.png) These are the correct endpoints. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 5, 2021, 6:19pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/17 "2021-03-05T18:19:28Z")
What happens if you start the discovery process with “opc.tcp://10.0.1.156:55105” instead of what you had, which defaulted to 4840. ---
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 6:20pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/18 "2021-03-05T18:20:10Z")
I was trying to do that but I couldn’t get it working. I’m not super familiar with the compose instructions and syntax yet. My compose file: ```auto version: '3.1' services: gateway: image: kcollins/ignition:8.1.2 # You can change `latest` to a specific version, e.g. `8.0.5` ports: - "8088:8088" # - "55105:55105" stop_grace_period: 30s secrets: - gateway-password volumes: # - ./gateway_backup.gwbk:/restore.gwbk - gateway_data:/var/lib/ignition/data logging: driver: "json-file" options: max-size: "200k" max-file: "10" environment: GATEWAY_SYSTEM_NAME: DockerGW GATEWAY_ADMIN_USERNAME: david GATEWAY_ADMIN_PASSWORD_FILE: /run/secrets/gateway-password db: image: postgres:13.1 ports: # Note that the 5432 port doesn't need to be published here for the gateway container to connect, # only for external connectivity to the database. - "5432:5432" volumes: - db_data:/var/lib/postgresql/data - ./db-init:/docker-entrypoint-initdb.d logging: driver: "json-file" options: max-size: "200k" max-file: "10" secrets: - postgres-password environment: # See https://hub.docker.com/_/postgres/ for more information POSTGRES_PASSWORD_FILE: /run/secrets/postgres-password POSTGRES_DB: ignition POSTGRES_USER: ignition secrets: postgres-password: file: ./secrets/POSTGRES_PASSWORD gateway-password: file: ./secrets/GATEWAY_PASSWORD volumes: gateway_data: db_data: ``` ---
**Author:** ![iamthebull](https://avatars.discourse-cdn.com/v4/letter/i/58f4c7/32.png) [@iamthebull](https://forum.inductiveautomation.com/u/iamthebull)\ **Post date:** [March 5, 2021, 6:21pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/19 "2021-03-05T18:21:22Z")
> [@Kevin.Herron](#): > > What happens if you start the discovery process with “opc.tcp://10.0.1.156:55105” instead of what you had, which defaulted to 4840. UaException: status=Bad\_Timeout, message=io.netty.channel.ConnectTimeoutException: connection timed out: /10.0.1.156:55105 ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 5, 2021, 6:25pm UTC](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150/20 "2021-03-05T18:25:32Z")
Well… I give up. It’s either networking problems or security problems on the server side. Don’t know what else to try 😕 [Next page](https://forum.inductiveautomation.com/t/unable-to-connect-to-opc-server-ignition-in-docker-container/44150.md?page=2)