Your own MQTT broker on private IPs for cellular devices
Updated
On a private APN, devices reach your MQTT broker on its private IP address; nothing on the internet can reach either of them. Bind the broker to that address only, keep TLS with client certificates, and allow only the SIM address range in your firewall. The example below uses Eclipse Mosquitto; the same rules apply to any broker.
Status: Coming soon (checked 26 October 2026) · Notify me when available
Minimal Mosquitto configuration
# mosquitto.conf: listen on the private address only, TLS with client certificates
listener 8883 10.20.0.10
cafile /etc/mosquitto/ca/devices-ca.crt
certfile /etc/mosquitto/certs/broker.crt
keyfile /etc/mosquitto/certs/broker.key
require_certificate true
use_identity_as_username true
allow_anonymous false
What each line does, from the mosquitto.conf manual:
| Option | Effect |
|---|---|
listener port [bind address] | listens on that port, only on the given address |
cafile, certfile, keyfile | certificate authority for clients, broker certificate and key |
require_certificate true | each client must present a valid certificate |
use_identity_as_username true | the certificate’s Common Name becomes the MQTT user name, for access rules |
allow_anonymous false | refuses clients without credentials |
Network rules
- Address plan: choose the SIM range (for example 10.64.0.0/16) so it overlaps none of your networks.
- Firewall: allow TCP 8883 from the SIM range to the broker, nothing else (8883 is the port IANA registers for secure MQTT, 1883 for MQTT without TLS: IANA port registry).
- Return path: route the SIM range back towards the private delivery link (Direct Connect, ExpressRoute, Interconnect, cross-connect or IPsec).
- DNS: give the private APN a DNS server that knows the broker’s name, or configure the IP address on devices.
Tips for cellular devices
- Keep-alive above the device’s reporting cycle, so the broker does not drop sleeping devices too early.
- MQTT v5 session expiry lets a device keep its subscriptions while it sleeps in PSM.
- Small payloads: cellular data is billed by volume; compact JSON or CBOR keeps costs down.
- Constrained modules (NB-IoT in particular) may do better with LwM2M over CoAP on UDP than with MQTT over TCP and TLS.
Where to run it: AWS, Azure, Google Cloud or your datacenter. The SIMs: IoT SIM cards.
Frequently asked questions
Does an MQTT broker on a private APN still need TLS?
The network path is private, but TLS with client certificates still proves which device is connecting and protects data inside your own network. It also lets you reuse the same broker configuration on the internet later.
How do I make Mosquitto listen only on a private address?
The listener option takes a port and an optional bind address, for example listener 8883 10.20.0.10. Mosquitto then accepts connections on that address only.
Which ports does MQTT use?
1883 for MQTT without TLS and 8883 for MQTT over TLS, as registered with IANA.
Can devices find the broker by name?
Yes, if the private APN's DNS server resolves that name. Give the APN a resolver you control, or use the broker's private IP address directly in small deployments.