Port 8883: MQTT over TLS

What uses port 8883

MQTT clients connecting over untrusted networks should use 8883, where the broker presents a TLS certificate and can require client certificates. AWS IoT Core, Azure IoT Hub and HiveMQ Cloud all use 8883 for device connections.

Should port 8883 be open to the internet?

Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.

Check what is listening on port 8883

sudo ss -ltnp 'sport = :8883'

sudo lsof -nP -iTCP:8883 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 8883 -State Listen
netstat -ano | findstr :8883

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 8883

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:8883 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 8883 -State Listen).OwningProcess

Open port 8883 in the firewall

sudo ufw allow 8883/tcp
# Close it again:
sudo ufw delete allow 8883/tcp

sudo firewall-cmd --permanent --add-port=8883/tcp
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "MQTT over TLS 8883/TCP" -Direction Inbound -Protocol TCP -LocalPort 8883 -Action Allow

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 8883 with Docker

docker run -d -p 8883:8883 eclipse-mosquitto

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 8883 from another machine

nc -zv example.com 8883

Test-NetConnection example.com -Port 8883

Related ports

• Port 1883 (MQTT): the default port for MQTT, the publish/subscribe protocol for IoT.
• Port 443 (HTTPS): the default port for HTTPS, encrypted web traffic.

More messaging and queues ports

4222 (NATS) , 4369 (Erlang Port Mapper (epmd)) , 5060 (SIP) , 5222 (XMPP client) , 5672 (AMQP (RabbitMQ)) , 9092 (Apache Kafka) , 15672 (RabbitMQ management) . See all ports in the port lookup.

Sources

• IANA port registry: 8883

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions