Set firewall rules for MQTT connections

This chapter describes how to allow incoming network connections to an MQTT broker via TCP port 1883 and configure the corresponding firewall rules.

Proceed as follows:

1. To allow incoming network connections to TCP port 1883 for MQTT clients, create the file /etc/nftables.conf.d/60-mosquitto-container.conf with the following content:

table inet filter {
  chain input {
    # accept connection to mqtt broker
    tcp dport 1883 accept
  }
}

table inet filter {
    chain forward {
        type filter hook forward priority 0; policy drop;

        # Allow forwarding of packets with TCP source port 1883
        tcp sport 1883 accept

        # Allow forwarding of packets with TCP destination port 1883
        tcp dport 1883 accept
    }
}

2. Apply the rules by reloading the nftables configuration on Beckhoff RT Linux^®. /etc/nftables.conf.d/* already includes this: sudo systemctl reload nftables

3. Next, restart the Docker^® service so that Docker® can recreate its network rules, which were discarded when nftables was reloaded: sudo systemctl restart docker