I forgot to write that Activemq is behind HAProxy as pfsense plugin. The client MQTT connects to the the public pfsense WAN->nat to VIP -> VIP is HAProxy frontend -> backend with one server.
HAproxy frontend is set as tcp. ActiveMQ listen on: <transportConnector name="openwire" uri="tcp://0.0.0.0:61616?maximumConnections=1000&wireFormat.maxFrameSize=104857600" /> <transportConnector name="amqp" uri="amqp://0.0.0.0:5672?maximumConnections=1000&wireFormat.maxFrameSize=104857600" /> <transportConnector name="stomp" uri="stomp://0.0.0.0:61613?maximumConnections=1000&wireFormat.maxFrameSize=104857600" /> <transportConnector name="mqtt" uri="mqtt://0.0.0.0:1883?maximumConnections=1000&wireFormat.maxFrameSize=104857600" /> <transportConnector name="ws" uri="ws://0.0.0.0:61614?maximumConnections=1000&wireFormat.maxFrameSize=104857600" /> -- Sent from: http://activemq.2283324.n4.nabble.com/ActiveMQ-User-f2341805.html