基于MQTT与Mosquitto Broker跨网向远程PC发布数据的可行性及实现方法

Absolutely! Mosquitto is fully capable of facilitating MQTT communication between devices on separate networks—this is one of the core strengths of the MQTT protocol. Let’s walk through exactly how to set this up, step by step:

1. Configure Mosquitto to Accept Remote Connections #

By default, Mosquitto often binds only to localhost (meaning it won’t listen for external connections). To fix this:

• Open your Mosquitto configuration file (usually mosquitto.conf; location varies by OS—Linux might be /etc/mosquitto/mosquitto.conf, Windows in the Mosquitto install directory).
• Find the bind_address line. Either comment it out with a # or set it to 0.0.0.0 (this tells Mosquitto to listen on all network interfaces).
• If you haven’t set up authentication yet, ensure allow_anonymous true is uncommented (note: this is insecure for public networks—we’ll cover secure options later).
• Restart the Mosquitto service to apply changes:
  • Linux: sudo systemctl restart mosquitto
  • Windows: Open Services, find "Mosquitto Broker", and click "Restart".

2. Open Firewalls & Set Up Port Forwarding #

Your Broker needs to be reachable from the internet, so you’ll need to handle two key network steps:

• Local Firewall: Allow incoming traffic on Mosquitto’s default ports:
  • Unencrypted MQTT: Port 1883 (TCP)
  • Encrypted MQTT (TLS): Port 8883 (TCP)
    Example for Linux with UFW: sudo ufw allow 1883/tcp
    For Windows: Go to Windows Defender Firewall → Advanced Settings → Inbound Rules → New Rule, and allow traffic on the desired port.
• Router Port Forwarding: If your Mosquitto Broker is on a local network (behind a router), you need to forward external traffic from the router’s public IP to the Broker’s local IP and port. Log into your router’s admin panel, find the "Port Forwarding" section, and add a rule mapping:
  • External Port: 1883 (or 8883 for TLS)
  • Internal IP: Your Broker machine’s local IP (e.g., 192.168.1.100)
  • Internal Port: 1883 (or 8883)

3. Get Your Broker’s Public Access Address #

Remote PCs need a way to find your Broker:

• If your internet connection has a static public IP, use that IP address directly.
• If you have a dynamic public IP (most home connections do), use a Dynamic DNS (DDNS) service to map a domain name to your changing IP. Many routers have built-in DDNS support, or you can use services like No-IP or DuckDNS.

4. Connect the Remote PC’s MQTT Client #

On the remote PC, use any MQTT client (like mosquitto_sub for testing) to connect to your Broker:

• Basic unencrypted connection:

  mosquitto_sub -h your_public_ip_or_ddns_domain -p 1883 -t "your/topic/name"
  

• If you set up username/password authentication:

  mosquitto_sub -h your_public_ip_or_ddns_domain -p 1883 -t "your/topic/name" -u "your_username" -P "your_password"
  

• For TLS-encrypted connections (recommended for public networks):

  mosquitto_sub -h your_public_ip_or_ddns_domain -p 8883 -t "your/topic/name" --cafile "/path/to/ca.crt"
  

5. (Critical for Security) Enable TLS Encryption #

Sending unencrypted MQTT traffic over the internet is risky—anyone can intercept your data. To set up TLS:

• Generate a self-signed SSL/TLS certificate (or use a trusted one from Let’s Encrypt).
• Update your mosquitto.conf to enable the TLS listener:

  listener 8883
  cafile /path/to/ca.crt
  certfile /path/to/server.crt
  keyfile /path/to/server.key
  

• Restart Mosquitto, and configure your clients to use the CA certificate when connecting.

Common Troubleshooting Tips #

• If the remote client can’t connect, check:
  • Is port forwarding correctly set up? Use an online port checker to verify your Broker’s port is open.
  • Did your ISP block port 1883? Try using an alternative port (like 18883) and update your firewall/port forwarding rules accordingly.
  • Is your Broker’s local IP static? If it changes, your port forwarding rule will break—set a static IP for the Broker machine in your router.

内容的提问来源于stack exchange，提问作者LearningDev