Port 27017: MongoDB

What uses port 27017

MongoDB servers accept connections on 27017; in sharded clusters, mongos routers commonly use 27017 too, with config servers on 27019 and shards on 27018. MongoDB Atlas connection strings (mongodb+srv://) find hosts through DNS and connect on 27017. Since 3.6, MongoDB binds to localhost by default after many ransom attacks on open databases.

Should port 27017 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Enable access control (security.authorization: enabled) before binding to anything other than localhost, and never expose 27017 to the internet.

Check what is listening on port 27017

sudo ss -ltnp 'sport = :27017'

sudo lsof -nP -iTCP:27017 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 27017 -State Listen
netstat -ano | findstr :27017

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 27017

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:27017 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 27017 -State Listen).OwningProcess

Allow port 27017 from trusted networks only

The examples allow 27017 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 27017 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 27017 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="27017" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "MongoDB 27017/TCP" -Direction Inbound -Protocol TCP -LocalPort 27017 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 27017 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 27017:27017 would expose the port to the whole network.
docker run -d -p 127.0.0.1:27017:27017 mongo

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 27017 from another machine

nc -zv example.com 27017

Test-NetConnection example.com -Port 27017

Related ports

• Port 5432 (PostgreSQL): the default port for PostgreSQL.
• Port 6379 (Redis): the default port for Redis and Valkey.

More databases ports

1433 (Microsoft SQL Server) , 1434 (SQL Server Browser) , 1521 (Oracle Database) , 3306 (MySQL / MariaDB) , 8086 (InfluxDB) , 9042 (Cassandra / ScyllaDB) , 9200 (Elasticsearch / OpenSearch) , 9300 (Elasticsearch transport) . See all ports in the port lookup.

Sources

• IANA port registry: 27017

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions