MongoDB Documentation, Release 3.0.4 Given the default ports (page 327) of all MongoDB processes, you must configure networking rules that permit only required communication between your application and the appropriate mongod and mongos instances. Be aware that, by default, the default policy of iptables is to allow all connections and traffic unless explicitly disabled. The configuration changes outlined in this document will create rules that explicitly allow traffic from specific addresses and on specific ports, using a default policy that drops all traffic that is not explicitly allowed. When you have properly configured your iptables rules to allow only the traffic that you want to permit, you can Change Default Policy to DROP (page 338). This section contains a number of patterns and examples for configuring iptables for use with MongoDB deploy- ments. If you have configured different ports using the port configuration setting, you will need to modify the rules accordingly. Traffic to and from mongod Instances This pattern is applicable to all mongod instances running as standalone instances or as part of a replica set . The goal of this pattern is to explicitly allow traffic to the mongod instance from the application server. In the following examples, replace <ip-address> with the IP address of the application server: iptables -A INPUT -s <ip-address> -p tcp --destination-port 27017 -m state --state NEW,ESTABLISHED iptables -A OUTPUT -d <ip-address> -p tcp --source-port 27017 -m state --state ESTABLISHED -j ACCEPT The first rule allows all incoming traffic from <ip-address> on port 27017 , which allows the application server to connect to the mongod instance. The second rule, allows outgoing traffic from the mongod to reach the application server. If you have only one application server, you can replace <ip-address> with either the IP address itself, such as: 198.51.100.55 . You can also express this using CIDR notation as 198.51.100.55/32 . If you want to permit a larger block of possible IP addresses you can allow traffic from a /24 using one of the following specifications for the <ip-address> , as follows: 10.10.10.10/24 10.10.10.10/255.255.255.0 Traffic to and from mongos Instances mongos instances provide query routing for sharded clusters . Clients connect to mongos instances, which behave from the client’s perspective as mongod instances. In turn, the mongos connects to all mongod instances that are components of the sharded cluster. Use the same iptables command to allow traffic to and from these instances as you would from the mongod instances that are members of the replica set. Take the configuration outlined in the Traffic to and from mongod Instances (page 336) section as an example. Traffic to and from a MongoDB Config Server Config servers, host the config database that stores metadata for sharded clusters. Each production cluster has three config servers, initiated using the mongod --configsvr option. 28 Config servers listen for connections on port 27019 . As a result, add the following iptables rules to the config server to allow incoming and outgoing connection on port 27019 , for connection to the other config servers. 28 You also can run a config server by using the configsvr value for the clusterRole setting in a configuration file. Optional Patterns Chapter 6. Security 336