Is BACnet/IP Safe to Expose to the Internet?

The Founder's Explanation (Teach Exactly This Way)

"Leaving your house key under the doormat on a busy public street — anyone who thinks to look, finds it. Putting BACnet/IP directly on the internet is exactly that. BACnet was built to trust its own network, not the open world. Keep it inside, on its own subnet, and if you must reach it from outside, go through a secured gateway — never leave the key under the mat."

Teaching the Concept

The Key Under the Doormat Leaving your house key under the doormat on a public street means anyone who thinks to look will find it. Putting BACnet/IP directly on the internet is exactly that — it was built to trust its own network, not the open world. Keep it inside, and reach it only through a secured gateway. BACnet/IP on the Internet? No. ``` DIRECT EXPOSURE controllers discoverable + abusable SAFE PATTERN isolate BACnet/IP on its own subnet remote access via SECURED GATEWAY only (outbound, TLS, certificate-based) ``` The Safe Remote Path ``` Never port-forward BACnet/IP to the internet Instead gateway dials out (TLS 8883); operator reaches the building through the secured cloud/broker ``` BACnet/IP belongs on an isolated subnet, never the open internet — reach it through a secured gateway and give attackers nothing to find.

---

Related Topics

• What is BACnet and its history? — the open building-automation protocol
• What is a protocol in BMS? — the shared language controllers use to talk
• Browse all Protocols topics — more from this section of the EnSmart BMS Library