Port 1883: MQTT

What uses port 1883

IoT devices, sensors and home automation systems (Home Assistant, Zigbee2MQTT) publish and subscribe to topics on an MQTT broker such as Mosquitto, EMQX or HiveMQ. Port 1883 is unencrypted; MQTT over TLS uses 8883, and MQTT over WebSockets often uses 8083/8084 or 443.

Should port 1883 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Thousands of brokers on the internet allow anonymous access and leak sensor data. Set allow_anonymous false in Mosquitto and use 8883 with TLS for remote devices.

Check what is listening on port 1883

sudo ss -ltnp 'sport = :1883'

sudo lsof -nP -iTCP:1883 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 1883 -State Listen
netstat -ano | findstr :1883

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 1883

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:1883 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 1883 -State Listen).OwningProcess

Allow port 1883 from trusted networks only

The examples allow 1883 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 1883 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 1883 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="1883" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "MQTT 1883/TCP" -Direction Inbound -Protocol TCP -LocalPort 1883 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 1883 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 1883:1883 would expose the port to the whole network.
docker run -d -p 127.0.0.1:1883:1883 eclipse-mosquitto

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 1883 from another machine

nc -zv example.com 1883

Test-NetConnection example.com -Port 1883

Related ports

• Port 8883 (MQTT over TLS): the port for MQTT secured with TLS.
• Port 5672 (AMQP (RabbitMQ)): the AMQP port used by RabbitMQ and other message brokers.
• Port 4222 (NATS): the client port of the NATS messaging system.

More messaging and queues ports

4369 (Erlang Port Mapper (epmd)) , 5060 (SIP) , 5222 (XMPP client) , 9092 (Apache Kafka) , 15672 (RabbitMQ management) . See all ports in the port lookup.

Sources

• IANA port registry: 1883

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions