Port 8883 (MQTT over TLS)

MQTT secured with TLS; used by AWS IoT Core, Azure IoT Hub and most cloud IoT platforms.

Registered (user) port, 1024-49151 TCP IoT and devices Expose only to trusted sources

What port 8883 is used for

MQTT secured with TLS; used by AWS IoT Core, Azure IoT Hub and most cloud IoT platforms.

Expose only to trusted sources. Safe to expose with TLS and per-device credentials or client certificates.

Service nameProtoDescriptionAssigneeReference

secure-mqtt TCP Secure MQTT OASIS -

secure-mqtt UDP Secure MQTT OASIS -

Registry dates for this port: registered 2008-02-27, last modified 2015-03-06.

Linux: is anything listening on TCP 8883?

sudo ss -tlnp 'sport = :8883'

Linux / macOS: which process owns the port

sudo lsof -nP -i :8883

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':8883 '

Windows (Command Prompt)

netstat -ano | findstr :8883

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 8883 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 8883

From Windows

Test-NetConnection HOST -Port 8883

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 8883 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 8883 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8883 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 8883 accept
sudo nft add rule inet filter input tcp dport 8883 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 8883 trusted' -Direction Inbound -Protocol TCP -LocalPort 8883 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.