Bind MongoDB to a private interface

The fix/etc/mongod.conf

net:
  port: 27017
  bindIp: 127.0.0.1

Or, to serve a private network explicitly:

net:
  bindIp: 127.0.0.1,10.0.1.5

sudo systemctl restart mongod

Why it matters more here than elsewhere

On every other service in this collection, binding is the first layer and authentication is the second. On MongoDB, authentication is off by default — so until you enable it, bindIp is not the first layer, it is the only one.

That asymmetry is the entire history of MongoDB’s security reputation. Before 3.6 the default was to bind every interface, and combined with no authentication it meant a stock install on a public IP was an open, writable database. Tens of thousands were found and wiped.

MongoDB 3.6 changed the default to 127.0.0.1, which is why fresh installs are no longer catastrophic out of the box. The default is now correct. This page is about the things that change it back.

What changes it back

• The official Docker image binds all interfaces. Correct for a container — one that only accepts loopback inside its own namespace is useless. The exposure is the published port: -p 27017:27017 puts it on every interface of the host. Use -p 127.0.0.1:27017:27017, or no published port at all when only sibling containers connect.
• bindIpAll: true, which is the setting people reach for when a remote client can’t connect. It means every interface, and it is almost never what was actually needed.
• Cloud provisioning templates and Helm charts that assume a private network exists, which is true right up until a security group is wrong.
• Someone debugging. Same story as trust in Postgres: the change that makes the error go away outlives the debugging session.

Because MongoDB isn’t in your distro’s repos, nobody packaged a safer default for you — you get MongoDB’s own defaults or whatever the image author chose.

Binding is not firewalling

A private-network bind still accepts connections from everything on that network: every other tenant, container, and compromised host that can route to it. Bind narrows the interface; a firewall narrows the source. On a database with no authentication yet, you want both — and you want authentication more than either.

Verify it worked

Check what’s actually listening:

sudo ss -lntp | grep mongod

Expect 127.0.0.1:27017. 0.0.0.0:27017 or *:27017 means every interface.

Confirm against the running server, in case the file and reality disagree:

db.adminCommand({ getCmdLineOpts: 1 }).parsed.net

In Docker the config is a red herring — the published port is what matters:

docker port <container> 27017

0.0.0.0:27017 there means it’s on every interface of the host no matter what bindIp says.

Then prove it from another machine:

mongosh --host your.db --serverSelectionTimeoutMS 5000 --quiet --eval 'db.version()'

A timeout is the goal. A version string means an open MongoDB — and if authorization isn’t enabled, it means an open, writable database. Go to the threat page.

Before you apply this

MongoDB has no reload — this needs a restart, and every connection drops.

Narrowing the bind disconnects any client not on the remaining interface, and they will not come back. Find out who’s connected first:

db.adminCommand({ currentOp: 1, $all: true }).inprog
  .filter(o => o.client)
  .map(o => o.client.split(':')[0])
  .filter((v, i, a) => a.indexOf(v) === i)

Every address there needs to reach an interface you keep. As always, that shows only current connections — check your application config and any scheduled job too.

On a replica set this is more delicate. Members connect to each other over the network, so binding to loopback only will break replication. Members need an interface the other members can reach:

net:
  bindIp: 127.0.0.1,10.0.1.5     # loopback + the replication interface

Restart secondaries one at a time and step the primary down last, or you’ll trigger an election in the middle of the change.

Related

• Enable authorization — do this too; binding alone is not enough.
• MongoDB exposed to the internet — what happens when this is wrong.