Port 27017MongoDB

What port 27017 is used for

Applications connect to a MongoDB instance (mongod) or a sharded-cluster router (mongos) on 27017 using the MongoDB wire protocol. Drivers for every major language, the mongosh shell and MongoDB Compass all use it.

The exposure history

Between 2015 and 2017, automated attackers found tens of thousands of MongoDB servers on the internet with no authentication, deleted their data and left ransom notes. The cause was a combination of bindIp defaulting to all interfaces and authentication being off. MongoDB changed the binding default in 3.6, but authentication is still opt-in, so the checklist remains:

1. Enable access control and create an administrative user before anything else.
2. Bind only to loopback and private interfaces.
3. Firewall 27017 to application hosts.
4. Enable TLS for connections across shared networks.
5. Keep backups; a wiped database cannot be recovered any other way.

How to check port 27017

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :27017

A line in the LISTENING state means a local program has bound port 27017; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :27017 or lsof -i :27017.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection mongo.internal.example -Port 27017

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 27017. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Test with mongosh:

mongosh "mongodb://mongo.internal.example:27017/" --eval "db.runCommand({ ping: 1 })"

Firewall considerations

Allow inbound 27017 only from application servers and replica-set peers. Managed offerings such as Atlas should use private endpoints or peering rather than public IP allow-lists.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 27017 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.