External MQTT sensor through CloudFlare

Configuration
1

I’ve added the CloudFlare add-on and now accessing HA remotely via the tunnel, all working fine.
I have an external sensor with ESPHome updating MQTT.
The connection was a simple:

mqtt:
  broker: mqtt.mydomain.com
  port: 1884
  username: !secret mqtt_user
  password: !secret mqtt_password
  birth_message:
    topic: myavailability/topic
    payload: en line
  will_message:
    topic: myavailability/topic
    payload: hors line

Now this is no longer working and I totally understand why…
I tried adding a new tunnel on CloudFlare but it remains innactive, how to I make the link?

2

Same question here. Spent hours…

3

It looks like port 1884 is not one we can use from a free account with CloudFlare according to this page:
https://developers.cloudflare.com/fundamentals/get-started/reference/network-ports/

So I ended up setting up dynamic DNS for my IP and forwarding 1884 on my firewall. The rest of HA is working well via CloudFlare so I guess I’ve accomplished 50% of my goal.

4

For anyone else who needs this, assume you’re OK with:

Then I got this working for publishing/subscripting to the mosquito-broker (that is spun-up by the MQTT add-on) externally (to my home-network), again using the websocket protocol by configuring the cloudflared add-on to specify in the additional_hosts section as follows:

       "options": {
-        "additional_hosts": [],
+        "additional_hosts": [
+          {
+            "hostname": "mqtt-home.yourdomain.com",
+            "service": "http://core-mosquitto:1884"
+          }
+        ],

(the above is a diff from the addon.json (i track my changes in git), please YAML’ify it as needed - you’ll then need to restart cloudflared add-on)

I then confirmed/tested it working externally using a container, connecting to the mqtt-home.yourdomain.com:80 (i chose port 80 for simplicity):

$ docker run -it --rm hivemq/mqtt-cli pub -t test/topic -m "Hello MQTT over WebSocket woohoo" -h mqtt-home.yourdomain.com -p 80 -ws -u 'mqtt-user' -pw 'mqtt-password'

In order to confirm messages were arriving, in another window, i would already be running before executing previous command in my local network:

$ docker run -it --rm hivemq/mqtt-cli sub -t test/topic -h homeassistant.lan -p 1884 -ws -u 'mqtt-user' -pw 'mqtt-password'
Hello MQTT over WebSocket woohoo

if TLS is a hard-requirement for you, you could point it to https://core-mosquitto:8884 (and you’d need to update the port you use to one of the HTTPS ports allowed by cloudflare)

I was able to test it using:

$ docker run -it --rm hivemq/mqtt-cli pub -t test/topic -m "Hello MQTT over WebSocket+TLS?" -u 'mqtt-user' -pw 'mqtt-password' -h mqtt-home.mydomain.com -p 443 -ws -s --tls-version TLSv1.2

Note: the device you’re setting up external mqtt-access for needs to be able to support a custom port (80 for non-TLS or 443 for TLS in my case) and the websocket protocol (often specified as ws://mqtt-home.mydomain.com:80/ or wss://mqtt-home.mydomain.com:443/ or using a flag to specify the websocket protocol to be used).