Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The fastest repeatable way to self-host EMQX is to run its official Docker image on a supported Linux VPS, persist the broker’s data and logs on the host, expose only the listeners your clients need, and enable authentication, authorization, and TLS before accepting Internet traffic. This guide takes you from an empty VPS to a tested, maintainable single-node broker.
What you are building
EMQX is an MQTT broker: clients connect to it, publish messages to topics, and subscribe to topics without connecting directly to one another. On a VPS, the broker has a public or privately routed hostname, a firewall, persistent storage, and one or more MQTT listeners. Docker keeps the broker installation repeatable and makes upgrades or replacement easier, while host-mounted directories preserve node state and logs when the container is recreated.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →This procedure targets a single Linux VPS. EMQX also supports package installation on a computer or virtual machine running Ubuntu, Debian, Rocky Linux/RHEL, or Amazon Linux. The package route can fit an existing service-management standard, but Docker is the shortest documented path for a new deployment.
Prerequisites and design decisions
Choose the VPS and operating system
- Use a supported 64-bit Linux distribution with Docker Engine and a provider firewall or security group.
- Give the server a static public address if clients connect from outside your private network.
- Create a fully qualified domain name such as
broker.example.comand point its DNS record at the VPS address. - Use a UTF-8 locale on the host. A locale such as
en_US.UTF-8avoids encoding surprises in logs, clients, and integrations. - Check that the ports you intend to publish are free before starting the container.
There is no universal “EMQX VPS size.” CPU, memory, disk, and connection capacity depend on concurrent clients, message rate, payload size, retained messages, rules, integrations, and logging. Start with a monitored instance sized for your workload, then load-test and resize rather than relying on a generic connection claim.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Set the node name before first start
Choose a stable node name in the form emqx@<host>, for example emqx@broker.example.com. The host portion should resolve consistently from the VPS and match the name you intend to keep. EMQX documentation warns that changing a node name later can cause data loss, so do not use a temporary hostname or an address you expect to change.
Decide which listeners clients actually need
| Port | Protocol | Typical use | Internet exposure |
|---|---|---|---|
| 1883/TCP | MQTT over TCP | Plaintext MQTT | Keep internal or transitional; do not use for untrusted networks. |
| 8883/TCP | MQTT over SSL/TLS | Encrypted native MQTT clients | Preferred for Internet MQTT traffic. |
| 8083/TCP | MQTT over WebSocket | Browser or WebSocket clients without TLS | Expose only when required and only on trusted networks. |
| 8084/TCP | Secure WebSocket | Encrypted browser/WebSocket clients | Preferred WebSocket listener on untrusted networks. |
| 18083/TCP | HTTP | EMQX Dashboard and REST API | Restrict to an administrator network or VPN. |
| 4370/TCP and 5370/TCP (plus offsets) | Erlang distribution and cluster RPC | Internal node and cluster control | Never open these to the public Internet. |
Opening every listener is unnecessary and increases attack surface. For a production deployment, many installations need only 8883, optionally 8084, and a tightly restricted 18083. Keep 1883 or 8083 disabled unless a specific client population requires plaintext access.
Prepare the VPS
Install Docker and verify the host
Install Docker Engine using the instructions for your Linux distribution, then verify that the daemon is running:
docker version
docker infoRun the following checks before creating the broker:
hostname --fqdn
locale
ss -ltnpThe first command should return the stable hostname used in your node name. The locale output should include a UTF-8 locale. The socket listing lets you detect a service already occupying an EMQX port.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Create persistent directories
Keep EMQX state and file logs outside the container. The data directory contains node state; the log directory contains file logs and crash dumps. The container runs as the emqx user with UID 1000, so that user must be able to write the mounted log directory.
sudo mkdir -p /opt/emqx/data /opt/emqx/log
sudo chown -R 1000:1000 /opt/emqx/log
sudo chmod 750 /opt/emqx/data /opt/emqx/logIf your host security policy uses SELinux, apply the appropriate container volume labels for your distribution. Do not solve a permission error by making the directories world-writable.
Start EMQX with Docker
Use a deliberately pinned image tag
The following is a representative single-node command using the official Enterprise image tag emqx/emqx-enterprise:6.3.1. Release tags are time-sensitive: check the current EMQX release and licensing terms before deploying, then pin the exact version you have approved instead of silently following latest.
docker run -d
--name emqx
--restart unless-stopped
-e EMQX_NODE__NAME=emqx@broker.example.com
-p 1883:1883
-p 8883:8883
-p 8083:8083
-p 8084:8084
-p 18083:18083
-v /opt/emqx/data:/opt/emqx/data
-v /opt/emqx/log:/opt/emqx/log
emqx/emqx-enterprise:6.3.1Replace broker.example.com with the permanent DNS name. Publish only the ports you selected in your design; removing an unused -p mapping is safer than publishing it and relying on clients never to use it. If you use a package installation instead, apply the same node-name, listener, persistence, and security decisions through the package’s service configuration.
Confirm that the container is healthy
docker ps --filter name=emqx
docker logs --tail=100 emqx
ss -ltnp | grep -E ':(1883|8083|8084|8883|18083)b'You should see the container running, startup messages without fatal errors, and listeners bound only to the ports you mapped. A missing listener usually means its port was not published, the host port was already occupied, or the configuration failed validation. Inspect the complete log before changing settings.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Configure the VPS firewall
Use both the provider’s security group and the host firewall. The exact command syntax varies by distribution; this example uses UFW. Replace the administrator network with your fixed office or VPN CIDR rather than allowing the entire Internet.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow from 203.0.113.0/24 to any port 18083 proto tcp
sudo ufw allow 8883/tcp
sudo ufw allow 8084/tcp
sudo ufw enable
sudo ufw status verboseDo not add 4370 or 5370 to public firewall rules. If you need 1883, 8083, or Dashboard access from a private network, restrict each rule to that network. Keep an emergency console or provider out-of-band access available before enabling a deny-by-default policy so a mistaken rule does not lock you out.
Open the Dashboard and replace the quick-start credentials
For the quick-start configuration, open http://<host>:18083/ from an allowed administrator network. The getting-started example uses admin / public as the initial credentials. Treat them as bootstrap credentials only: change the password immediately, then restrict or remove broad access to port 18083.
Do not expose the Dashboard directly to the whole Internet merely because clients need MQTT. Put administrative access behind a VPN, a provider security-group rule, or a narrowly scoped corporate address range. The Dashboard and REST API are management surfaces, not message listeners.
Enable authentication and authorization before accepting clients
EMQX allows all clients to connect when authentication is not enabled. Configure an authentication source and authorization rules before publishing the broker’s address to real devices. Depending on your environment, the source can be a database, an HTTP service, LDAP, or another supported identity system.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Authentication
- Create identities for applications or devices instead of sharing one global account.
- Use credentials with enough entropy for non-interactive clients and protect them in the device or deployment secret store.
- Decide whether client IDs must be unique and enforce that policy to prevent accidental session takeover.
- Test a valid login and an invalid login from a separate client before production cutover.
Authorization and ACLs
- Allow each identity to publish and subscribe only to its required topic namespace.
- Separate telemetry, commands, retained configuration, and administrative topics.
- Deny wildcard access unless an application genuinely needs it.
- Test both an allowed operation and an operation that should be rejected; a successful TCP connection alone does not prove that ACLs work.
Use TLS for production MQTT
Use a certificate issued by a trusted certificate authority or by a controlled internal PKI. Configure the 8883 listener for native MQTT and 8084 for secure WebSockets when those protocols are needed. Disable legacy protocol versions and weak ciphers according to your organization’s security baseline, and rotate certificates before they expire.
For mutual TLS, clients present certificates and EMQX verifies them against a trusted CA bundle. Certificate-to-username or certificate-to-client-ID mapping requires peer verification; a server certificate alone does not establish the client’s identity.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Certificate deployment checklist
- Use a DNS name in the certificate’s subject alternative name that matches the name clients use.
- Install the complete certificate chain expected by clients, along with the private key protected from non-administrative users.
- Set an expiry monitoring alert and document the replacement procedure.
- Verify protocol negotiation with a test client before switching devices from 1883 to 8883.
Do not call plaintext 1883 “secure” because the client also has a password. Credentials and messages remain observable on an untrusted network without transport encryption.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test the broker from a client
Test encrypted MQTT with a command-line client
Install an MQTT command-line client on a separate machine. Substitute a real test account, the certificate authority file trusted by your client, and the broker hostname.
mosquitto_sub
-h broker.example.com
-p 8883
--cafile /path/to/ca.crt
-u test-device
-P 'replace-with-test-secret'
-t lab/echo
-dIn another terminal, publish a message:
mosquitto_pub
-h broker.example.com
-p 8883
--cafile /path/to/ca.crt
-u test-device
-P 'replace-with-test-secret'
-t lab/echo
-m 'hello from the VPS'
-dThe subscriber should receive the message, and the debug output should show a successful TLS and MQTT session. Repeat with an invalid password and with a topic outside the account’s ACL; both attempts should be rejected. If the client reports a certificate-name error, connect using the DNS name covered by the certificate rather than the raw IP address.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Test WebSockets only when required
For browser applications, use 8084 with a secure WebSocket MQTT library and the same certificate, authentication, and ACL policies. Keep 8083 closed unless a trusted internal application specifically requires unencrypted WebSockets.
Recommended Free Tools
Backups, upgrades, and day-to-day operations
Back up the data directory
Back up /opt/emqx/data periodically for production safety, excluding the trace folder as recommended by the installation guidance. Store backups away from the VPS and protect them like credentials because broker state may include configuration or identity data.
sudo tar --exclude='/opt/emqx/data/trace'
-czf /var/backups/emqx-data-$(date +%F).tar.gz
/opt/emqx/dataThis creates a local archive only; copy it to your protected backup system and apply retention rules there. Test a restore on a staging VPS and document the exact node-name, version, permissions, and startup steps. A backup that has never been restored is an unverified recovery plan.
Upgrade deliberately
- Read the release notes for the target EMQX version and confirm compatibility with your configuration and integrations.
- Take and verify a data backup.
- Record the currently running image tag and configuration.
- Stop and replace the container with the approved pinned tag while retaining both host mounts.
- Review startup logs, listener availability, authentication, ACLs, and a publish/subscribe test before declaring the upgrade complete.
Never delete the host data directory as part of routine container replacement. Doing so removes the persistent state you created the deployment to preserve.
Set limits for the expected connection scale
Check file-descriptor and service limits on the VPS and set them to match the expected number of connections and sockets. Monitor CPU, memory, disk utilization, open connections, message throughput, retained data, and log growth. Increase capacity when measured workload approaches the limits; do not infer capacity from the Docker container being “up.”
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Keep cluster traffic private
A single node does not need public Erlang distribution or cluster RPC access. If you later build an EMQX cluster, place nodes on a private network, use stable private hostnames, and permit ports 4370, 5370, and their configured offsets only between cluster members. Do not reuse public listener firewall rules for these control ports.
Troubleshooting common failures
The container exits immediately
- Run
docker logs emqxand look for an invalid setting, unreadable mount, or port-binding error. - Confirm that
/opt/emqx/logis writable by UID 1000. - Check that the node name is valid and that the hostname resolves as expected.
- Use the exact image tag you intended; a typo or unavailable tag prevents startup.
Clients cannot connect
- Confirm the listener is mapped with
docker psand is listening withss -ltnp. - Check both the provider security group and the host firewall.
- Verify that the client is using the correct protocol and port: 8883 for MQTT over TLS, 8084 for secure WebSockets.
- Inspect certificate hostname, trust chain, credentials, and ACLs separately; fixing one does not fix the others.
The Dashboard is unreachable
- Check that 18083 is mapped and that your source address is allowed by the firewall.
- Use the VPS’s DNS name or address that the firewall rule covers.
- Review container logs for a failed Dashboard listener, then close the port again once administrative access is confirmed through a safer network path.
Data or logs disappear after replacement
Inspect the container mounts with docker inspect emqx. If the paths are not mapped to /opt/emqx/data and /opt/emqx/log, the container was using ephemeral storage. Recreate it with the host mounts and restore from a verified backup when necessary.
Quick Recap
Go-live checklist
- Resolve the VPS FQDN and confirm that it matches the permanent EMQX node name.
- Run the pinned Docker image with persistent data and log mounts.
- Open only the required listener ports to the intended networks.
- Log in to the Dashboard, replace the quick-start password, and restrict port 18083.
- Configure authentication and ACLs, then prove that an unauthorized client is rejected.
- Install a trusted certificate and test MQTT over 8883 or secure WebSockets over 8084.
- Publish and subscribe with a test client while reviewing broker status and logs.
- Back up the data directory without the
tracefolder and document a tested staging restore. - Set monitoring and file-descriptor limits appropriate to the measured workload.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
