KNX / KNXnet/IP
KNX is a building-automation control standard for lighting, shading, HVAC, metering, room-state, and adjacent environmental automation. Native KNX TP, KNX RF, and KNX PL segments are not IP services and do not have firewall ports. The IT schedule only becomes a port conversation when KNXnet/IP, KNX IP Secure, a KNX IP interface/router, a visualization server, an object server, or another gateway is in the path.
Scope: KNX / KNXnet/IP — select the deployed product/version; optional services require separate selection.
protocol · Catalog reviewed 2026-09-27
Infrastructure Requirements
- Compatible KNX bus devices and IP interfaces/routers
- selected tunnelling or routing mode
- secure commissioning material where KNX Secure is used.
Network & Physical Requirements
| Port / allocation | Transport | Connection / signal flow | Feature and requirement | Evidence |
|---|---|---|---|---|
| 3671 (default) | UDP Multicast: Routing: 224.0.23.12 by default | KNX/IP router or tunnelling client → KNX/IP peers or tunnelling server | Profile requirement · Core KNXnet/IP routing or UDP tunnelling KNXnet/IP supported mode | Source checked 2026-09-27 Properties > KNXnet/IP Tunneling; KNXnet/IP Routing |
| 3671 (default) | TCP | Tunnelling client → KNX/IP interface | Optional · TCP / IP Secure KNXnet/IP TCP / secure tunnelling Supported TCP secure tunnelling profile | Source checked 2026-09-27 IP Tunneling > KNXnet/IP Tunneling; Port property |
Physical, link and configuration requirements
configuration · Profile requirement · Core
Native KNX TP/RF/PL is separate from the IP gateway. Secure commissioning requires the correct device authentication and project keys.
KNX native and secure configuration
Source checked 2026-09-27
Interface types and secured area line; USB medium; KNXnet/IP Routing
Gotchas & IT Notes
- ⚠Do not write firewall rules for "KNX" without first identifying the medium: TP, RF, PL, IP, or IoT. Only the IP-facing pieces belong in an IT port schedule.
- ⚠UDP 3671 is the practical baseline for KNXnet/IP tunneling/routing, with 224.0.23.12 as the default multicast address for routing/search behavior. Keep that traffic inside the building-control/AV-control boundary; do not expose it to the internet.
- ⚠IANA registers port 3671 as efcp / e Field Control (EIBnet) for both TCP and UDP. That registry entry is useful evidence of the port assignment, not proof that every KNX endpoint uses both transports.
- ⚠KNX Association security guidance explicitly pushes toward closing KNX router ports toward the internet, setting KNXnet/IP router default gateway to 0, using firewalls, and using VPN rather than direct remote port exposure.
- ⚠KNX's own workflow guidance recommends changing the default KNXnet/IP multicast address where appropriate. That is a segmentation/hardening choice, but it must be coordinated with every router/interface/controller that expects to discover or route on the default group.