Knowledge Base

Symptoms

• MQTT clients can connect using localhost, but cannot connect using the broker computer’s network IP address.
• Remote clients report a connection timeout or a connection refused error.
• The broker appears to be running, but accepts only local connections.

These symptoms can also have other causes, including firewall rules or authentication failures. On the broker computer, run the following command to check port 1883:

netstat -ano | findstr :1883

For example, the following output shows listeners bound to the loopback interfaces:

TCP    127.0.0.1:1883    0.0.0.0:0    LISTENING    <PID>
TCP    [::1]:1883        [::]:0       LISTENING    <PID>

Compare the PID with the Mosquitto process in Task Manager; another application may also use port 1883. If there is no listener on the port, check that the broker is running and using the expected configuration.

Configuration

Security warning: This example permits any client that can reach the listener to connect without a username or password. It does not enable TLS. Use it only temporarily on a trusted test network. Do not expose this listener to the Internet or use it for production.

Step 1: Configure the listener

1. Identify the configuration file used by the running Mosquitto service. A common installation path is:C:\Program Files\Mosquitto\mosquitto.conf
2. Open the configuration file in a text editor running as administrator. Back up the file before making changes.
3. Add or update the following directives:
   listener 1883 0.0.0.0
allow_anonymous true
   
   Listens on TCP port 1883 on all available IPv4 interfaces.
   Allows clients to connect without username/password authentication. Check for existing listeners and authentication settings first. Modify the appropriate settings rather than adding a conflicting listener on the same address and port. Retain any existing authentication and access-control configuration required by your installation; do not enable anonymous access on a production broker.
4. Save the file.

Step 2: Restart Mosquitto

1. Open Services (services.msc).
2. Locate the Mosquitto service and restart it.
3. Confirm that the service is running. If it fails to start, check the Mosquitto logs, the configuration file, and whether another process is already using the port.

Step 3: Verify the listening interface

Run the following command again on the broker computer:

netstat -ano | findstr :1883

Expected output includes a line similar to:

TCP    0.0.0.0:1883    0.0.0.0:0    LISTENING    <PID>

Confirm that the PID belongs to Mosquitto. 0.0.0.0 indicates that the listener is bound to all IPv4 interfaces; it is not an address that clients should use to connect.

Step 4: Allow traffic through Windows Firewall if needed

If remote connections are blocked by Windows Firewall, create an inbound TCP rule on the broker computer. The example below applies only to the Domain and Private profiles and restricts access to 192.168.1.0/24. Replace this subnet with your trusted client network before running the command in an elevated PowerShell window:

New-NetFirewallRule `
    -DisplayName "Mosquitto Broker (TCP 1883)" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 1883 `
    -RemoteAddress 192.168.1.0/24 `
    -Profile Domain,Private `
    -Action Allow

Check the active Windows network profile and any other firewall or network controls. A rule for Domain and Private profiles does not allow traffic on a Public profile. Follow your organization’s firewall policy and remove the test rule when it is no longer needed.

Step 5: Test MQTT connectivity

Find the broker computer’s IPv4 address with ipconfig. From a client on the trusted network, open a PowerShell window and run the following command. Replace 192.168.1.10 with the broker’s actual IPv4 address. The example assumes the Mosquitto client tools are installed at the shown path; adjust it if necessary.

& mosquitto_sub -h 192.168.1.10 -p 1883 -t "test/topic" -v -d

Leave the subscriber running and check its debug output for a successful SUBACK. In a second PowerShell window on a client that can reach the broker, publish a test message:

& mosquitto_pub -h 192.168.1.10 -p 1883 -t "test/topic" -m "Hello from MQTT"

The subscriber should display:

test/topic Hello from MQTT

Receiving the message confirms that the client can reach the broker and publish and subscribe to this topic. If the test fails, check the broker IP address, port, listener PID, service logs, authentication or topic permissions, network routing, and firewall rules.

Production security

For production, disable anonymous access and configure authentication and topic access controls appropriate to your deployment. Restrict firewall access to trusted clients or networks, and configure TLS to protect credentials and MQTT traffic in transit. Test the secured configuration with clients configured to use the appropriate credentials and TLS settings.

References

• Eclipse Mosquitto configuration reference