# This setting means that all listeners have their own authentication/access control settings
per_listener_settings true

# Define our listener for external connections, with password
# authentication
listener 1883
password_file /path/to/password_file
allow_anonymous false
# If you need TLS encryption:
# cafile /path/to/certificate/authority/certificates
# certfile /path/to/server/certificate
# keyfile /path/to/server/key

# Define a listener that binds to 127.0.0.1, which means only clients
#  on the local machine can use it to connect. No authentication required. 
# This isn't usable for the wider local network though.
listener 1884 127.0.0.1

# Define a listener with no authentication. Because this has a separate port
# to the external listener, you could use some firewall rules to disallow access
# to clients that did not originate on your local network. 
listener 1885