Is port 1883 (MQTT) open on my router, and how do I close it?

Why this matters

MQTT (Message Queuing Telemetry Transport) is a publish-subscribe messaging protocol built to be lightweight enough for small IoT devices, and it’s the backbone of a huge share of smart-home, building-automation and industrial sensor deployments. A device “publishes” a message to a topic (like home/livingroom/temperature), and anything “subscribed” to that topic receives it, all routed through a central broker. IANA registers port 1883 as MQTT’s default plaintext port, and 8883 for MQTT over TLS.

The protocol itself, per the OASIS MQTT 5.0 standard, explicitly supports authentication — Section 5 covers “Authentication of Clients by the Server” and recommends implementations “SHOULD offer Authentication, Authorization and secure communication options.” Critically, though, MQTT does not require authentication by default, and many broker software packages ship with anonymous access enabled out of the box, for ease of setup. If that broker is also reachable from the public internet, anyone who finds it can subscribe to every topic (reading everything being published — sensor readings, camera trigger events, door-lock states) or publish their own messages, which connected devices may act on without question.

Step 1: check if you’re actually exposed

Don’t assume — check directly. AdminKit’s MQTT exposure check tests whether a broker is reachable at the standard MQTT ports and whether it accepts an anonymous connection, which is the specific combination that matters (a broker that’s reachable but requires valid credentials is a very different situation from one that accepts anyone).

If you want a broader picture of what else is open on your connection first, run port check against your own IP (only with your own consent — it only ever scans the IP making the request) to see which commonly-exposed device ports, including 1883, are currently reachable from outside.

To find your current public IP before running these checks from outside your own network, use what is my IP.

Step 2: find what’s actually running the broker

If 1883 shows open and accepting connections, the next step is identifying the source on your own network, since closing the port on your router is only half the fix if the underlying device keeps re-opening it (some smart-home hubs use UPnP to request port forwards automatically every time they restart):

1. Check your router’s port-forwarding or UPnP-mapped-ports list for an entry pointing at 1883 or 8883.
2. Identify which device that forward points to — smart-home hubs (Home Assistant installs, proprietary hub devices), NVRs, and some building-automation gateways are the most common sources.
3. Check that device’s own configuration for a setting like “remote access,” “cloud bridge,” or “external MQTT” — this is often what triggered the port forward in the first place, and disabling it may remove the need for the forward entirely.

Step 3: close it or secure it

You generally have two options, and they aren’t mutually exclusive:

Close the port if you don’t need internet access to the broker at all (the common case — most smart-home automations only need devices to reach the broker locally):

• Remove the port-forwarding rule for 1883/8883 from your router’s admin page.
• Disable UPnP on your router if the device re-creates the forward automatically; UPnP lets devices on your network open ports without asking you each time, which is convenient but removes a layer of control.
• Re-run MQTT exposure check afterward to confirm the broker is no longer reachable from outside.

If you genuinely need remote access to the broker (for example, checking sensor data while away from home):

• Require authentication on the broker — disable anonymous access in the broker’s configuration and set a username/password or client certificates for every client.
• Use TLS (port 8883) rather than plaintext 1883 for any connection that crosses the public internet.
• Restrict access by source IP where your broker software supports it, rather than leaving it open to any address.
• Consider a VPN into your home or office network instead of exposing the broker port directly — this keeps the broker itself unreachable from the open internet entirely.

Common sources of an exposed broker

A few device categories account for most of the accidental MQTT exposure we’d expect to see on home and small-business networks:

• Home Assistant installs that enable the built-in MQTT broker add-on for local automations, where a port forward added for an unrelated reason (remote dashboard access, for example) can incidentally expose the broker too if it isn’t scoped carefully.
• NVRs and camera systems that use MQTT internally to publish motion-detection events, sometimes with a broker that listens on all network interfaces by default rather than just localhost.
• Building-automation gateways bridging older BACnet or Modbus equipment into an MQTT-based dashboard, often installed by a contractor who prioritized getting the integration working over locking down the broker afterward.
• DIY IoT projects (a Raspberry Pi running Mosquitto or a similar broker for a hobby project) where a port forward was added during setup and simply never removed once the project was working.

Knowing which of these applies to your situation makes Step 2 above faster — you’re not searching blind, you’re confirming a specific likely source.

This is a protocol-wide pattern, not a one-off bug

The gap here isn’t a bug in any specific product — it’s a consequence of a protocol designed for lightweight, often resource-constrained devices, where mandatory authentication adds overhead some deployments skip. The same pattern shows up with other machine protocols; see our guide on Modbus TCP exposure for a closely related issue on industrial networks, where the stakes of an unauthenticated, internet-reachable protocol are often even higher.

AdminKit’s planned Secure MQTT Broker is designed to require authentication by default with no anonymous-access option, plus per-topic access control so one device can’t read or write topics it has no reason to touch — it is in early access and not available yet, so today’s practical options are the manual steps above.