I would like to access from my Windows PC a KNX interface that is wired to a Linux PC trought my wireguard VPN but the interface is on a different subnet. The KNX interface use UDP protocol on port 3671. See image below :

My current network:

My current network

I have already set the ipv4.forwarding and tried to add a route with this :

iptables -t nat -A PREROUTING -p tcp -d --dport 3671 -j DNAT --to

I added this rule too to the linux iptables : -A FORWARD -d -p udp -m udp --dport 3671 -j ACCEPT \

I tried to connect to my interface with my KNX software but I get no response. I only have basic understanding of route networking and don't know any tool that could help me solve this.

  • Do you want a route or do you want NAT? Those are different things. Nov 19, 2022 at 5:51
  • @mashuptwice Since the interface need to send me packets back, I think that a route is more suitable for my needs.
    – ZacMo
    Nov 21, 2022 at 10:00
  • Well, both the router your windows PC is connected to as well as the KNX device have the same subnet. You'll need to change one of them to use a different subnet than, otherwise a route will not work. Nov 21, 2022 at 10:21
  • I thought about this, until today I only tried to add route in the Linux PC but it seems now clear that I need a route in my Windows PC too, am I right ? I'll change the subnet of eth0 and the KNX interface to
    – ZacMo
    Nov 21, 2022 at 10:53
  • Yes, you'll need a route on every hop between the sender and receiver. traceroute or mtr can be a great help when identifying missing routes. Nov 21, 2022 at 12:19

1 Answer 1


To solve the problem, I added the subnet of my interface ( to the client (the Linux PC) AllowedIps of the wireguard server configuration file. Doing this will result in wireguard itself creating the route in my VPN server.

I then created one route in my Windows PC with the command : route add MASK

My Windows PC was on another subnet ( to avoid conflict or I should have changed the eth0 and KNX interface subnet to something not already used in my network but that was not doable in my case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.