A secure, one-way data replication system for OPC UA servers using UDP over hardware data diodes. This solution enables safe mirroring of OPC UA data from high-security networks to lower-security networks without risk of reverse communication.
- ✅ Auto-discovery of OPC UA server structure (Variables, Objects, Methods)
- ✅ Real-time data synchronization with configurable subscription intervals
- ✅ Hardware data diode compatible (one-way UDP communication)
- ✅ Optional compression (zlib, lz4) for bandwidth optimization
- ✅ Optional encryption (AES-128-GCM, AES-256-GCM, ChaCha20-Poly1305)
- ✅ Multiple interfaces:
- Graphical GUI (Tkinter - Windows/Linux/macOS)
- Terminal GUI (ncurses - SSH/terminal access)
- Command-line (headless operation)
- ✅ Automatic clipboard support for encryption key sharing
- ✅ Structure change monitoring and automatic resynchronization
- ✅ Comprehensive logging and statistics
┌─────────────────────┐ ┌──────────────┐ ┌─────────────────────┐
│ OPC UA Server │◄────────┤ SENDER ├────────►│ Hardware Data │
│ (Source Network) │ TCP │ (Reader) │ UDP │ Diode │
└─────────────────────┘ └──────────────┘ └──────────┬──────────┘
│ One-way
┌───────────▼──────────┐
│ RECEIVER │
│ (Writer) │
└──────────┬───────────┘
│ TCP
┌──────────▼───────────┐
│ Shadow OPC UA │
│ Server │
│ (Target Network) │
└──────────────────────┘
- Industrial OT/IT separation: Safely replicate process data from OT network to IT network
- DMZ data access: Provide read-only access to OPC UA data in demilitarized zones
- Security compliance: Meet air-gap requirements while maintaining data visibility
- Remote monitoring: Enable safe monitoring of critical infrastructure
- Data archival: Stream data to historians without reverse connectivity
# Install from PyPI
pip install opcua-data-diode
# Or install from source
git clone https://github.com/cherubimro/opcua-data-diode.git
cd opcua-data-diode
pip install -e .- Generate encryption key (sender side):
python3 -m opcua_data_diode.gui.sender_gui
# Click "Generate New Key" - key is automatically copied to clipboard- Configure sender (
sender_config.json):
{
"opcua_server_url": "opc.tcp://192.168.1.100:4840",
"udp_host": "192.168.2.100",
"udp_port": 5555,
"compression": {"enabled": true, "method": "lz4"},
"encryption": {"enabled": true, "algorithm": "aes-256-gcm", "key": "YOUR_KEY_HERE"}
}- Configure receiver (
receiver_config.json):
{
"udp_host": "0.0.0.0",
"udp_port": 5555,
"shadow_server_port": 4841,
"encryption": {"enabled": true, "algorithm": "aes-256-gcm", "key": "YOUR_KEY_HERE"}
}
⚠️ IMPORTANT: Always start the RECEIVER and the real OPC UA Server first, then start the SENDER. The sender requires both the receiver and the real OPC UA server to be running before it can establish the connection.
Graphical Interface (Tkinter):
# 1. Start RECEIVER first
opcua-receiver-gui
# 2. Then start SENDER
opcua-sender-guiTerminal Interface (ncurses):
# 1. Start RECEIVER first
opcua-receiver-tui
# 2. Then start SENDER
opcua-sender-tuiCommand Line (headless):
# 1. Start RECEIVER first
opcua-receiver receiver_config.json
# 2. Then start SENDER
opcua-sender sender_config.json- Cross-platform (Windows, Linux, macOS)
- Configuration editor with validation
- Red/green status indicators (clickable to start/stop)
- Password visibility toggle
- About dialog with GPL license
- Perfect for SSH access or headless systems
- Interactive configuration editing
- Selection menus for algorithms and compression
- Keyboard shortcuts (S:Start, X:Stop, G:GenKey, F3:Save, Q:Quit)
- Real-time status updates
- AES-128-GCM: Fast, secure (128-bit keys)
- AES-256-GCM: Slower, more secure (256-bit keys) - RECOMMENDED
- ChaCha20-Poly1305: Fastest, modern (256-bit keys)
All algorithms use AEAD (Authenticated Encryption with Associated Data) providing both confidentiality and integrity.
- zlib: Standard compression, good ratio (~50-70% reduction)
- lz4: Faster compression, lower ratio (~30-50% reduction)
Compression is applied before encryption.
The system generates detailed statistics files:
discovery_statistics.txt: Node discovery summaryskip_statistics.txt: Skipped nodes and reasonssender_auto.log: Sender runtime logsreceiver_auto.log: Receiver runtime logs
- Python 3.7 or higher
- For Tkinter GUI: python3-tk (Linux) or bundled (Windows/macOS)
- For ncurses GUI: ncurses (pre-installed on Linux/macOS)
- For clipboard support: xclip or xsel (Linux)
- UDP connectivity between sender and receiver
- Firewall rules allowing UDP port (default: 5555)
- TCP connectivity from sender to OPC UA server
- TCP connectivity from clients to shadow server
Compatible with commercial data diodes from:
- Any unidirectional network device supporting UDP
Tested with Prosys OPC UA Simulation Server (2443 nodes, 2023 variables):
- ~100ms subscription interval
- <5% CPU usage on modern hardware (typical)
- Bandwidth (varies with data change rate and compression):
- ~10-25 KB/s with zlib compression (level 6, default)
- ~15-30 KB/s with lz4 compression (faster, optional)
- Uncompressed bandwidth depends on data change frequency and payload size
Note: Actual bandwidth depends heavily on:
- Number of variables changing simultaneously
- Data change frequency (subscription interval)
- Variable data types and array sizes
- Network conditions and compression settings
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
See LICENSE for details.
Alin-Adrian Anton Email: alin.anton@upt.ro Copyright (C) 2026
For issues, questions, or feature requests:
- Open an issue on GitHub Issues
- Email: alin.anton@upt.ro
- Review logs in
sender_auto.logandreceiver_auto.log
- Built with python-asyncua
- Uses cryptography for encryption
- GUI built with Tkinter and ncurses
- Web-based monitoring dashboard
- Prometheus metrics exporter
- Docker containers
- Kubernetes deployment examples
- HA/failover support
- Performance metrics collection
- MQTT bridge support
Made for industrial cybersecurity