Port reference
Port 1883 (TCP) – MQTT
Default port for MQTT, the lightweight publish/subscribe messaging protocol used across IoT deployments; the TLS variant runs on 8883.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Many brokers (e.g. Mosquitto) allow anonymous access by default and bind broadly. Plain MQTT on 1883 is unencrypted, leaving topics and payloads readable to anyone who can reach the port.
What is port 1883 used for?
Port 1883 is the default for MQTT, a lightweight publish/subscribe messaging protocol widely used in IoT and home automation. Devices and apps connect to a central broker — such as Eclipse Mosquitto, HiveMQ, or EMQX — to publish and subscribe to topics, which is how platforms like Home Assistant tie sensors and switches together. Plain MQTT runs on 1883; the TLS-secured version uses 8883.
When would you open it?
Open or forward 1883 when you run an MQTT broker that devices on other networks must reach, for example remote IoT sensors reporting to a home server. If all your clients are on the same LAN as the broker, keep the port on the local network and don't forward it.
Is it safe to open?
Plain MQTT is unencrypted and many brokers allow anonymous access, so require a username/password, use TLS on 8883, and keep the broker on a private network or VPN. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1883
nmap -p 1883 <target>netstat -ano | findstr :1883
Test-NetConnection <host> -Port 1883lsof -i :1883
nmap -p 1883 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1883 to your device's local IP, internal port 1883, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1883/tcpsudo firewall-cmd --permanent --add-port=1883/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1883 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1883" -Direction Inbound -Protocol TCP -LocalPort 1883 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Anonymous connection to subscribe to all topics with a # wildcard
- Message injection and command publishing to actuator/control topics
- Payload and credential interception on unencrypted MQTT
- Enumeration of mass-exposed brokers via internet-wide scanning
Hardening
- Disable anonymous access; require username/password or client certificates
- Use MQTT over TLS on 8883 instead of plaintext 1883
- Bind to a private interface and firewall 1883 to trusted hosts
- Enforce per-client topic ACLs to limit subscribe/publish scope
- Keep broker software patched and audit connected clients
How to block this port
sudo ufw deny 1883/tcpsudo firewall-cmd --permanent --remove-port=1883/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1883 -j DROPNew-NetFirewallRule -DisplayName "Block 1883" -Direction Inbound -Protocol TCP -LocalPort 1883 -Action Blocknmap snippet
nmap -p1883 --script mqtt-subscribe <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is MQTT on port 1883 encrypted?
- No. Plain MQTT on 1883 is unencrypted and often allows anonymous access, so topics, payloads, and credentials can be read. Use MQTT over TLS on 8883 and require authentication.
- Why are MQTT brokers so commonly exposed?
- IoT deployments often expose 1883 to the internet with default anonymous settings. Attackers scan the whole internet for open brokers, then subscribe with the # wildcard to read every topic.