Port reference
Port 27017 (TCP) – MongoDB
Default port for the MongoDB NoSQL document database.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Older MongoDB versions bound to 0.0.0.0 with no authentication enabled by default. Modern packages bind to localhost and require auth, but countless legacy and misconfigured instances remain open.
What is port 27017 used for?
Port 27017 is the default port for MongoDB, one of the most popular NoSQL document databases. Web and mobile application back-ends connect to it to store and retrieve JSON-like documents, and admin tools such as the mongosh shell and MongoDB Compass use it too. If you run an app backed by MongoDB, this is the port the database listens on.
When would you open it?
Open it only on the private network between your application servers and the database — for example, so a web server can reach MongoDB on another host inside the same data center or VPC. There is almost never a reason to expose it to the public internet; remote admins should connect through a VPN or SSH tunnel instead.
Is it safe to open?
Exposed MongoDB instances without authentication have caused major breaches, so always enable authentication, bind to a private interface, and firewall the port. See the security notes below.
How to check if this port is open
ss -tulpn | grep :27017
nmap -p 27017 <target>netstat -ano | findstr :27017
Test-NetConnection <host> -Port 27017lsof -i :27017
nmap -p 27017 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 27017 to your device's local IP, internal port 27017, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 27017/tcpsudo firewall-cmd --permanent --add-port=27017/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 27017 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 27017" -Direction Inbound -Protocol TCP -LocalPort 27017 -Action AllowSecurity & risks
Common attacks
- Unauthenticated access to read, dump, or delete entire databases
- Ransom attacks that wipe data and leave a payment note
- NoSQL injection from exposed application layers
- Information disclosure of collections and credentials
Hardening
- Bind to localhost or a private interface (bindIp); never expose 27017 to the internet
- Enable authentication (--auth) and role-based access control
- Enforce strong, unique credentials and least-privilege roles
- Require TLS for client and intra-cluster traffic; firewall to trusted hosts
- Keep MongoDB patched and audit access
How to block this port
sudo ufw deny 27017/tcpsudo firewall-cmd --permanent --remove-port=27017/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 27017 -j DROPNew-NetFirewallRule -DisplayName "Block 27017" -Direction Inbound -Protocol TCP -LocalPort 27017 -Action Blocknmap snippet
nmap -p27017 --script mongodb-info,mongodb-databases <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is it safe to expose MongoDB on port 27017?
- No. Open MongoDB instances caused some of the largest data breaches and ransom waves on record. Bind to localhost or a private network, enable --auth, require TLS, and firewall the port.
- Why were so many MongoDB databases ransomed?
- Older defaults bound to all interfaces with no authentication, so anyone could connect, dump, and delete the data, then leave a ransom note demanding payment for its return.