Stop forwarding port 3671, says the KNX Association
The KNX Association's own security note says what every villa owner with remote access should hear, and here is our take on it and what we specify.
The KNX Association's warning about forwarded ports
On 21 September 2026 the KNX Association published a note on the IP side of KNX installations, and the risk it names is a plain one. Installers forward port 3671 through the villa's router so that they can reach the system from the office, and an installation that can be reached by its installer "could potentially be reached by somebody else as well". The note's recommendations are to stop forwarding the port, to use a VPN or a dedicated remote-access gateway with authenticated access, to put the KNX equipment on its own VLAN, and to move to KNX IP Secure devices, which add authentication, integrity, freshness and encryption to the IP medium. It adds that this can be done step by step, without ripping anything out. Source.
A shortcut on the router, not a flaw in KNX
This is the single most common thing we find on the villas we are asked to look at: a port forwarded years ago by someone who no longer works there. It is not a weakness in KNX, because the bus itself does not speak to the internet; it is a shortcut taken on the villa's router. Our designs put the KNX IP router on the IoT network, behind the villa's firewall, with no inbound port, and allow remote access only through the VPN on the villa's router. Where the budget allows, the IP router and interface are KNX IP Secure. Your installer will still be able to reach the system whenever you ask them to, and strangers will not.
One question to ask your installer
If you already have a system, ask whoever installed it a single question: "Is port 3671 forwarded on my router?" If the answer is yes, ask them to close it and set up a VPN instead. It is an afternoon's work.