Port 8883: MQTT over TLS

What is port 8883 used for?

Encrypted MQTT messaging for IoT devices.

Should port 8883 be open?

Usually open to the internet. This port is meant to be reachable publicly on servers that offer the service. The secure MQTT port. Require client authentication.

See what is listening on port 8883

# Linux
sudo ss -tlnp | grep ':8883 '

# macOS
sudo lsof -nP -i TCP:8883 -sTCP:LISTEN

# Windows (PowerShell)
Get-NetTCPConnection -LocalPort 8883 -State Listen

Open or block port 8883 in a firewall

# Ubuntu / Debian (ufw)
sudo ufw allow 8883/tcp
sudo ufw deny 8883/tcp

# Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "Port 8883" -Direction Inbound -Protocol TCP -LocalPort 8883 -Action Allow

On cloud servers, also open the port in the provider’s security group or network firewall. At home, a service behind a router needs a port-forwarding rule to the device’s local IP.

Test it from outside

A port can be open on the server but blocked upstream. The Port Checker connects from the internet, so it shows what the world sees. From your own machine, use nc -vz example.com 8883 (macOS/Linux) or Test-NetConnection example.com -Port 8883 (Windows).