Node-RED

What is Node-RED?

Node-RED is an open-source, flow-based development platform built on Node.js that lets you connect devices, protocols, databases and applications visually by wiring nodes together into data flows in a web browser. The platform is widely used for integration, automation, Edge Computing, IoT solutions and industrial data exchange. Within OT and industrial automation, Node-RED often acts as a flexible middleware layer between PLCs, SCADA, historians, cloud platforms and IIoT systems, which makes it a popular tool in OT convergence projects.

🧠 Where does Node-RED come from?

Nick O’Leary and Dave Conway-Jones started Node-RED in early 2013 as a side project within IBM’s Emerging Technology Services group. Their aim was to wire together hardware, APIs and online services quickly, without writing a full application for every integration. In September 2013 Node-RED was released as open source under the Apache 2.0 licence.

In October 2016 Node-RED became one of the founding projects of the JS Foundation. In 2019 that foundation merged with the Node.js Foundation to form the OpenJS Foundation, which still hosts Node-RED today. In 2021 Nick O’Leary co-founded FlowFuse (originally called FlowForge), a company that provides a management platform for Node-RED in industrial environments.

⚙️ How does Node-RED work?

Node-RED consists of a runtime (a Node.js process) and a browser-based editor, reachable on port 1880 by default. In the editor you drag nodes from a palette and connect them with wires. After a deploy, the runtime executes the flows on its own, even when the editor is closed.

Data travels between nodes as a message object msg, usually carrying msg.payload (the value) and msg.topic (the source or subject). A typical flow:

1. Input node - receives data, for example an MQTT message, an HTTP request or a periodic inject trigger
2. Processing nodes - filter, scale, convert or enrich the data; the function node runs your own JavaScript
3. Output node - forwards the result to a broker, database, API or email
4. Dashboard or storage nodes - visualise or persist the information

Flows are stored as a JSON file (flows.json); passwords and tokens live in a separate, encrypted credentials file. Variables can be kept in context at three levels: per node, per flow and global. Subflows let you build reusable building blocks, and the projects feature puts flows under Git version control.

🌐 Which protocols and systems does Node-RED support?

Node-RED ships with a small set of core nodes plus a library of thousands of community nodes that you install through the palette manager. The distinction matters for operations: each community node has its own maintainer and its own quality level.

There are also nodes for cloud platforms such as Azure, AWS and Google Cloud, and for MQTT Sparkplug B. This is why Node-RED often serves as a protocol gateway and as an ETL layer between OT systems and analytics platforms.

🏭 What is Node-RED used for in industry?

• Protocol conversion - for example Modbus TCP to MQTT, OPC UA to a REST API, or serial communication to a cloud platform
• Machine monitoring - collecting production status, cycle times, energy consumption and OEE data
• Unified Namespace - normalising PLC data and publishing it under a fixed topic structure
• SCADA extensions - email or chat notifications, event handling and MES integrations that the SCADA package does not offer itself
• Edge pre-processing - local filtering, buffering during connection loss and data reduction before sending to the cloud
• Condition Monitoring and Predictive Maintenance - watching sensor values for thresholds and trends

Vendors also build Node-RED into their hardware. Opto 22 ships Node-RED preinstalled on groov EPIC and groov RIO, the example image of the Siemens SIMATIC IOT2050 included Node-RED, and Revolution Pi supports it for I/O programming. Node-RED also runs on a Raspberry Pi, in Docker containers and on industrial PCs or edge devices.

📊 How do you build dashboards with Node-RED?

The original node-red-dashboard package was based on AngularJS, which is no longer maintained. In June 2024 maintainer Dave Conway-Jones announced that development would stop and the package would be marked deprecated. Its successor is FlowFuse Dashboard (also called Dashboard 2.0), built on Vue. Migration is not automatic: both can run side by side, but custom templates often have to be rebuilt.

Within OT, Node-RED dashboards are used for local monitoring, energy analysis, prototypes and simple HMIs at the edge. For richer visualisation and long-term trends, Node-RED is usually combined with InfluxDB and Grafana.

🔐 How do you secure Node-RED in an OT environment?

The official documentation is clear: the editor is not secured by default. Anyone who can reach the IP address and port can change and deploy flows. Because the function node runs arbitrary JavaScript and the exec node starts system commands, access to the editor is in practice equivalent to access to the underlying system and every connected PLC.

Node-RED supports roles through permissions (* for full access, read for read-only, or fine-grained such as flows.read), giving a basic form of RBAC. MFA is not built in, but you can add it through an external identity provider. Place Node-RED in its own zone in line with network segmentation and the zones and conduits model of IEC 62443, behind a firewall or in the DMZ, and avoid direct access from the IT network to critical PLCs. Apply hardening and least privilege: do not run the runtime as root and remove unused nodes.

🧭 How do you deploy Node-RED reliably, step by step?

Node-RED is regularly used in semi-critical OT processes. A practical approach:

1. Define the role - Node-RED suits monitoring, integration and data transport, not hard real-time control or safety functions; those belong in the PLC or the safety system.
2. Choose the platform - an industrial edge PC or a container; note that Node-RED 5.0 requires a 64-bit operating system and Node.js 22.9 or later; the Raspberry Pi 3B and older models are no longer supported.
3. Secure it before go-live - set adminAuth, TLS and a fixed credentialSecret in settings.js.
4. Design robust flows - read at fixed intervals or on change, buffer during connection loss and handle errors with catch and status nodes.
5. Set up configuration management - use projects with Git, document flows and record installed node versions.
6. Monitor and recover - send logs to a central system, watch memory usage for leaks and keep backups of flows.json and the credentials. Where downtime is unacceptable, provide redundancy.
7. Manage the lifecycle - plan Node.js and Node-RED updates within lifecycle management and change management, and check community nodes for known CVEs.

For Dutch organisations covered by the Cyberbeveiligingswet (in force since 15 August 2026), an undocumented Node-RED instance with write access to PLCs is a typical risk under the duty of care. Manufacturers that ship Node-RED inside a commercial product, such as an edge gateway, are responsible under the Cyber Resilience Act for vulnerabilities in those embedded components; the reporting obligation applies from 11 September 2026.

🔄 How does Node-RED compare with other integration platforms?

Node-RED usually does not replace SCADA, but fills in missing integration functions. With dozens of instances across multiple sites, governance, central management and security become the bottleneck; platforms such as FlowFuse add team management, snapshots and rollout to edge devices. In this way Node-RED supports initiatives around Industry 4.0, the Industrial Internet of Things and Industrial AI, as long as its use stays controlled. Within critical infrastructure, compliance and cybersecurity requirements often restrict cloud integration, and assets and data flows are kept under monitoring. For larger numbers of containers, Kubernetes can take over orchestration. That way Node-RED remains a bridge between IT and OT systems rather than an uncontrolled shadow layer.

❓ Frequently asked questions

Is Node-RED free?

Node-RED is free open-source software under the Apache 2.0 licence and is hosted by the OpenJS Foundation. You can install it without licence costs on a PC, Raspberry Pi, server or in Docker. Commercial parties such as FlowFuse offer paid management platforms and support around Node-RED.

Can Node-RED replace a PLC or SCADA system?

Node-RED is not suitable as a PLC replacement, because it offers no deterministic, hard real-time control and no safety functions. Node-RED usually does not replace a SCADA system either, because alarm management, a historian and redundancy are missing or have to be built yourself. Node-RED is strongest as an integration and data layer alongside PLC and SCADA.

Which programming language does Node-RED use?

Node-RED runs on Node.js and uses JavaScript for custom logic in the function node. Most flows, however, are built without code by wiring nodes together visually. Flows are stored as JSON, so you can easily export them, share them and put them under version control.

Which port does Node-RED run on?

Node-RED runs on port 1880 by default, where the editor, dashboards and HTTP endpoints are all served. The Node-RED editor is not secured by default, so this port must never be reachable unprotected from the internet or the office network. Enable adminAuth and TLS and restrict access with a firewall.

What is the difference between Node-RED Dashboard and FlowFuse Dashboard?

The original Node-RED Dashboard (node-red-dashboard) was based on AngularJS and has been deprecated since 2024. FlowFuse Dashboard, also called Dashboard 2.0, is its Vue-based successor with responsive layouts and new widgets. Existing dashboards do not migrate automatically and partly have to be rebuilt.

Does Node-RED support OPC UA and Modbus?

Node-RED supports OPC UA, Modbus TCP and Siemens S7 through community nodes that you install with the palette manager. MQTT, HTTP, WebSocket, TCP and UDP are built into Node-RED as standard. Review community nodes for maintenance and vulnerabilities before using them in a production environment.

📌 In summary

Node-RED is an open-source, visual integration layer that lets you quickly connect OT data from PLCs and sensors to MQTT, databases, dashboards and cloud platforms. It excels at protocol conversion, edge pre-processing and prototyping, but is unsuitable for hard real-time or safety functions. Because the editor is unsecured by default and can execute code, Node-RED belongs in a segmented zone with authentication, TLS, version control and active lifecycle management.