Port reference
Port 8883 (TCP) – MQTT over TLS
Default port for MQTT secured with TLS, the encrypted variant of the IoT publish/subscribe protocol that runs in plaintext on 1883.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Reserved for TLS-wrapped MQTT. Encryption is in place, but brokers may still permit anonymous access, accept weak certificates, or also expose plaintext 1883, undermining the protection.
What is port 8883 used for?
Port 8883 is the default for MQTT over TLS, the encrypted form of the lightweight publish/subscribe protocol used by IoT and home-automation devices. It is the same MQTT spoken in plaintext on port 1883, but wrapped in TLS so topics, payloads, and credentials are protected in transit. Clients and brokers like Eclipse Mosquitto, HiveMQ, and EMQX use it, and platforms such as Home Assistant and AWS IoT connect over it.
When would you open it?
Open or forward 8883 when you run an MQTT broker and need devices or applications to connect to it securely, including across the internet. It is the recommended port whenever MQTT traffic leaves a trusted local network.
Is it safe to open?
TLS protects the data in transit but is not access control, so still require authentication and disable plaintext 1883 to prevent downgrades. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8883
nmap -p 8883 <target>netstat -ano | findstr :8883
Test-NetConnection <host> -Port 8883lsof -i :8883
nmap -p 8883 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8883 to your device's local IP, internal port 8883, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8883/tcpsudo firewall-cmd --permanent --add-port=8883/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8883 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8883" -Direction Inbound -Protocol TCP -LocalPort 8883 -Action AllowSecurity & risks
Common attacks
- Anonymous or weak-credential login despite TLS being enabled
- Downgrade to plaintext MQTT on 1883 when both ports are open
- Exploitation of weak TLS configs or missing client-certificate checks
- Topic subscription with a # wildcard once authenticated
Hardening
- Require client authentication (passwords or mutual TLS certificates)
- Disable plaintext 1883 so clients cannot be downgraded
- Use modern TLS versions and strong cipher suites; validate certificates
- Enforce per-client topic ACLs to limit subscribe/publish scope
- Bind to a private interface, firewall 8883, and keep the broker patched
How to block this port
sudo ufw deny 8883/tcpsudo firewall-cmd --permanent --remove-port=8883/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8883 -j DROPNew-NetFirewallRule -DisplayName "Block 8883" -Direction Inbound -Protocol TCP -LocalPort 8883 -Action Blocknmap snippet
nmap -p8883 --script ssl-cert,mqtt-subscribe <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- How is port 8883 different from 1883?
- Port 8883 carries MQTT inside a TLS tunnel, encrypting topics, payloads, and credentials. Port 1883 is the same protocol in plaintext. Use 8883 and disable 1883 where possible.
- Does TLS on 8883 make MQTT secure by itself?
- No. TLS protects data in transit but not access control. You still need authentication, per-client topic ACLs, and strong certificate validation, or an attacker can authenticate and read or inject messages.