MongoDB Documentation, Release 3.0.4 iptables -A INPUT -s <ip-address> -p tcp --destination-port 27019 -m state --state NEW,ESTABLISHED iptables -A OUTPUT -d <ip-address> -p tcp --source-port 27019 -m state --state ESTABLISHED -j ACCEPT Replace <ip-address> with the address or address space of all the mongod that provide config servers. Additionally, config servers need to allow incoming connections from all of the mongos instances in the cluster and all mongod instances in the cluster. Add rules that resemble the following: iptables -A INPUT -s <ip-address> -p tcp --destination-port 27019 -m state --state NEW,ESTABLISHED Replace <ip-address> with the address of the mongos instances and the shard mongod instances. Traffic to and from a MongoDB Shard Server For shard servers, running as mongod --shardsvr 29 Because the default port number is 27018 when running with the shardsvr value for the clusterRole setting, you must configure the following iptables rules to allow traffic to and from each shard: iptables -A INPUT -s <ip-address> -p tcp --destination-port 27018 -m state --state NEW,ESTABLISHED iptables -A OUTPUT -d <ip-address> -p tcp --source-port 27018 -m state --state ESTABLISHED -j ACCEPT Replace the <ip-address> specification with the IP address of all mongod . This allows you to permit incoming and outgoing traffic between all shards including constituent replica set members, to: Furthermore, shards need to be able make outgoing connections to: Create a rule that resembles the following, and replace the <ip-address> with the address of the config servers and the mongos instances: iptables -A OUTPUT -d <ip-address> -p tcp --source-port 27018 -m state --state ESTABLISHED -j ACCEPT Replace <ip-address> with the address of the instance that needs access to the HTTP or REST interface. For all deployments, you should restrict access to this port to only the monitoring instance. iptables -A INPUT -s <ip-address> -p tcp --destination-port 28017 -m state --state For config server mongod instances running with the shardsvr value for the clusterRole setting, the rule would resemble the following: iptables -A INPUT -s <ip-address> -p tcp --destination-port 28018 -m state --state 29 You can also specify the shard server option with the shardsvr value for the clusterRole setting in the configuration file. Shard members are also often conventional replica sets using the default port. 30 All shards in a cluster need to be able to communicate with all other shards to facilitate chunk and balancing operations. 337 6.3. Security Tutorials Optional Provide Access For Monitoring Systems 1. The mongostat diagnostic tool, when running with the --discover needs to be able to reach all compo- nents of a cluster, including the config servers, the shard servers, and the mongos instances. 2. If your monitoring system needs access the HTTP interface, insert the following rule to the chain: • all mongod instances in the config servers. • all mongos instances. • all mongod instances in the shard’s replica sets. • all mongod instances in other shards. 30