Port 27017 (MongoDB)

What port 27017 is

TCP port 27017 is the default port of the MongoDB server (mongod) and the mongos router. mongosh, Compass and application drivers connect there, usually with a connection string such as mongodb://app:password@db.example.com:27017/shop. Sharded clusters use two more defaults:

Traffic is unencrypted unless TLS is configured. MongoDB Atlas requires TLS and uses mongodb+srv:// connection strings, which find the hosts through SRV records.

Should it be open to the internet?

No. Many thousands of MongoDB servers have been found open with no authentication, and automated attacks have repeatedly copied and dropped their databases, leaving a ransom note collection. Keep 27017 on loopback or a private network, and let only your application servers connect.

Locking it down

Since MongoDB 3.6, mongod binds to localhost by default. Check /etc/mongod.conf:

net:
  port: 27017
  bindIp: 127.0.0.1,192.0.2.10
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
security:
  authorization: enabled

• bindIp lists the addresses to listen on. Avoid 0.0.0.0 and bindIpAll: true unless a firewall restricts the port.
• authorization: enabled turns on access control. Create an admin user first, then one user per application:

use shop
db.createUser({ user: "app", pwd: passwordPrompt(), roles: [ { role: "readWrite", db: "shop" } ] })

Restart with sudo systemctl restart mongod after editing.

Firewall rules

sudo ufw allow from 192.0.2.20 to any port 27017 proto tcp

sudo iptables -A INPUT -p tcp -s 192.0.2.20 --dport 27017 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 27017 -j DROP

In the cloud, allow 27017 only from your application's security group or subnet. With Docker, the official image listens on all interfaces inside the container and starts without authentication unless you set MONGO_INITDB_ROOT_USERNAME and MONGO_INITDB_ROOT_PASSWORD. Publish it on loopback (-p 127.0.0.1:27017:27017) or not at all; ports published on all interfaces bypass ufw on most Linux hosts.

How to check what is listening

sudo ss -tlnp | grep ':27017'
sudo lsof -i :27017
mongosh --eval 'db.runCommand({ ping: 1 })'

To test from outside, run nc -zv db.example.com 27017 from another network. It should time out or be refused. Our Port Scanner does not probe 27017, so use this or a similar command.

"Port 27017 already in use"

Usually a system mongod and a container, or a mongod left running from an earlier shell. Find it with sudo lsof -i :27017 (on Windows, netstat -ano | findstr :27017), stop it, or run the new instance on another port with --port 27018 or -p 127.0.0.1:27018:27017. If mongod fails with "Address already in use" right after a crash, check for a stale process before deleting any lock file.

Related ports

• Port 9200: Elasticsearch, another data store often found exposed.
• Port 6379: Redis.
• Port 5432: PostgreSQL.
• Port 3306: MySQL.

To check the database ports our scanner does cover, such as 3306, 5432 and 6379, run the Port Scanner.