The KNX IP Router is the bridge between the KNX TP bus and the IP network — it serves simultaneously as a line coupler (connecting a TP line to the backbone), an IP backbone participant (allowing multiple TP lines to communicate via LAN), and a tunneling server (giving ETS6 on a laptop remote programming access to the TP bus without a USB interface). The MDT SCN-IP200.02 is the most widely deployed KNX IP Router in European projects. This is a complete setup guide.

Physical overview: MDT SCN-IP200.02

The SCN-IP200.02 occupies 2 DIN-rail modules (35mm DIN, same as a 2-module MCB). Its terminals: **Left side — TP bus terminals:** two screw terminals for the KNX TP bus (bus+, bus−). Bus-powered from the TP line via these terminals — no separate 24V supply required for the KNX portion. **Right side — IP interface:** RJ45 Ethernet port (100 Mbit, auto-negotiation, auto-MDIX). IP-powered from the same Ethernet cable via PoE (802.3af, class 1) — or alternatively, the device accepts 12–24V DC via an additional terminal for non-PoE switches. **Status LEDs:** TP bus activity (green, flashes on telegram), IP link (green, solid), IP activity (yellow, flashes on packet), programming mode (red, illuminates during ETS download). **Programming button:** For individual address assignment and physical programming mode. DIN-rail mounting: standard 35mm, tool-free snap-fit. In a typical KNX panel, the IP router mounts on the same DIN rail as the KNX power supply and other bus devices.

Individual address assignment in ETS6

The KNX individual address of an IP router defines both its role (backbone participant or line coupler) and the area/line topology it serves. **Backbone coupler address format (X.0.0):** An IP router addressed as 1.0.0 participates in the backbone for area 1. It does not connect to a specific TP line — it is a pure IP backbone participant. Use this format only when you have a dedicated IP backbone (backbone line = IP) and the router connects only to the IP network, not to a TP line. **Line coupler address format (X.Y.0):** An IP router addressed as 1.2.0 serves as the coupler between TP line 1.2 and the backbone. Devices on this TP line get addresses 1.2.1 through 1.2.63. This is the most common configuration — the router connects physically to the TP line (via its TP terminals) and to the IP backbone (via its RJ45 port). In ETS6: right-click the router device → Individual Address → enter the required address (e.g. 1.2.0). With the router in programming mode (red LED on, press programming button), ETS writes the individual address. Confirm: check that the router's TP bus LED flashes normally and that ETS6 can discover the device at its new address in the Network Interfaces panel.

Group address filter table

The filter table determines which KNX group address telegrams the router forwards between the TP line and the IP backbone. Without a filter table, the router blocks all telegrams — devices on TP line 1.2 cannot receive commands from a pushbutton on TP line 1.1. The filter table is the most frequently misunderstood element of KNX router configuration. **Why it matters:** Each TP line has a maximum telegram load. Forwarding every group address telegram across every line coupler wastes bus bandwidth and can cause bus overload on busy projects. The filter table selectively passes only the group addresses that have recipients on the other side. **How ETS6 populates it:** ETS6 automatically calculates the filter table from the group address assignments in your project. When you link a group address object on a device on line 1.2 to a GA that is also used by a device on line 1.1, ETS6 flags that GA for forwarding through the 1.2.0 router. **How to download it:** Select the router in your ETS6 project → right-click → Download → Download filter table. This is a separate download step from the device parameter download. The filter table download is fast (typically under 10 seconds) but must be repeated every time you add or remove GA bindings that cross line boundaries. Forgetting to re-download the filter table after project changes is the single most common cause of "my scene stopped working" bugs in multi-line KNX installations.

Tunneling connections

KNX IP tunneling allows ETS6 (or Home Assistant KNX integration) to send and receive individual KNX telegrams over IP, as if directly connected to the TP bus. The MDT SCN-IP200.02 supports a maximum of 4 simultaneous tunneling connections. Each tunneling connection is assigned its own individual address (separate from the router's own coupler address). In ETS6: open the router's parameter page → Tunneling tab → configure up to 4 connection slots. Each slot gets an individual address (typically X.Y.254, X.Y.253, X.Y.252, X.Y.251 by convention). **Password protection:** ETS6 allows setting a password for each tunneling connection in the router parameters. For professional installations, always set a password — this prevents unauthorised ETS6 access to the bus via the IP router from the LAN or internet. **Practical allocation:** Slot 1 = ETS6 primary programming connection (the engineering laptop). Slot 2 = Home Assistant KNX integration. Slot 3 = spare (remote access, SCADA, secondary HA instance). Slot 4 = spare. More than 4 concurrent active connections requires a second IP router or an IP interface (MDT SCN-IPTS.01 for pure tunneling without bus coupling).

Static IP configuration vs DHCP

The MDT SCN-IP200.02 supports both DHCP and static IP addressing. **Why static IP is mandatory for professional installations:** DHCP leases expire and renew. If the router's IP address changes (e.g. DHCP server restart, lease expiry, or router reboot during DHCP lease gap), ETS6 tunneling connections configured with the old IP address fail, Home Assistant KNX integration loses its connection, and any remote monitoring dashboard goes offline. Static IP eliminates this failure mode entirely. **Configuring static IP:** In ETS6 router parameters → IP Configuration tab → select Static IP. Enter: IP address (e.g. 192.168.1.100 — choose an address outside the DHCP pool range), Subnet mask (typically 255.255.255.0), Default gateway (your router/firewall IP). Alternatively: configure the DHCP server (router or server) to reserve a fixed IP for the KNX router's MAC address. The MAC address is printed on the device label. DHCP reservation is equally reliable to static IP if the DHCP server is stable — but static IP in the KNX device is preferable for installations where the network infrastructure may change independently.

Multicast group 224.0.23.12 and IGMP

KNX IP routing uses the IANA-assigned multicast group 224.0.23.12 for KNXnet/IP routing telegrams (the "routing" protocol, distinct from "tunneling"). All KNX IP routers on the same network segment join this multicast group and exchange routing telegrams via multicast UDP. **IGMP snooping:** If your managed switch has IGMP snooping enabled (as recommended for traffic efficiency), ensure the KNX multicast group is either excluded from IGMP snooping or the switch is configured to forward 224.0.23.12 to all ports in the KNX VLAN. Some managed switches with aggressive IGMP snooping block multicast groups that no host has explicitly joined — this silently breaks inter-router communication. Symptom: two IP routers on the same network cannot exchange routing telegrams; devices on line 1.1 cannot reach devices on line 1.2 despite both routers being reachable via tunneling. Fix: either disable IGMP snooping on the KNX VLAN, or add a static multicast group entry in the switch for 224.0.23.12 → all ports.

Remote programming via OpenVPN

For remote ETS6 programming access (service calls, firmware updates, project modifications without site visits): run OpenVPN (or WireGuard) on a server in the same LAN segment as the KNX IP routers. When the engineer connects via VPN, their laptop receives a VPN IP in the same subnet as the KNX network. ETS6 discovers the KNX IP router via KNXnet/IP discovery (UDP broadcast or known IP) and establishes a tunneling connection normally. This setup requires: VPN server accessible from internet (static IP or DynDNS on the site's internet connection), VPN credentials for the engineer, site network configured to route VPN client traffic to the KNX VLAN. Remote programming is slower than local (round-trip latency of 20–100ms vs <1ms locally) but fully functional for all ETS6 operations. Always confirm with the building owner before establishing remote access capability — document the VPN access configuration in the project handover dossier.

Troubleshooting

Heartbeat: The MDT SCN-IP200.02 sends a heartbeat UDP packet every 60 seconds to all active tunneling connections. If ETS6 or HA does not receive a heartbeat, the connection is considered lost and must be re-established. Monitor this in HA's KNX integration log — repeated "connection lost, reconnecting" messages indicate a network stability issue, not a KNX issue. Missing telegrams on IP side: If KNX devices respond normally to physical switches but not to commands from ETS6/HA over IP: (1) check the tunneling connection is established (green in ETS6 interfaces panel), (2) verify the filter table includes the relevant group addresses (re-download if uncertain), (3) check that the individual address of the tunneling connection is not conflicting with an existing TP device address. TP bus not visible via router: If ETS6 connects via tunneling but cannot discover TP devices: check the TP bus terminals are correctly wired (polarity matters for power, but not for data — however reversed polarity may prevent the device from powering the TP bus). Confirm the TP line has a functioning KNX power supply generating 29V. Measure bus voltage at the router's TP terminals with a multimeter — should be 21–29V DC.