Port 27017: MongoDB
What it is, why it matters and how to restrict it.
The default port of MongoDB. Databases left open with authentication switched off have repeatedly been found and wiped by scanners.
Secure it
Set net.bindIp in mongod.conf to the interfaces you need, enable authentication, and restrict the port to your application servers.
Allow only one address on Linux
sudo iptables -I INPUT 1 -p tcp --dport 27017 -j DROP sudo iptables -I INPUT 1 -p tcp -s 203.0.113.5 --dport 27017 -j ACCEPT
The drop rule goes in first and the allow rule is inserted above it, so 203.0.113.5 is matched first. Replace it with your own address. With ufw, the equivalent allow rule is:
sudo ufw allow from 203.0.113.5 to any port 27017 proto tcp
Check from outside
nc -vz SERVER_IP 27017
Run it from an allowed address and from another one. A connection should succeed from the first and fail or time out from the second. Build custom rules with allow a port from specific IPs, or see all common ports.
FAQ
What is port 27017 used for?
Port 27017 is the default TCP port of MongoDB.
Should port 27017 be open to the internet?
Usually not. Keep it on localhost, behind a VPN, or limited to specific source IPs.
How do I block port 27017 for everyone except one IP?
Add an ACCEPT rule for that address, then a DROP rule for the port below it. The commands above do this in the correct order.