Port reference
Port 28017 (TCP) – MongoDB HTTP Status (legacy)
Legacy MongoDB HTTP status/admin page exposing server and database information.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Older MongoDB versions enabled an HTTP status interface on 28017, often on 0.0.0.0 with no authentication. It leaks database, server, and operational detail and was removed in MongoDB 3.6.
What is port 28017 used for?
Port 28017 served the legacy MongoDB HTTP status page — a built-in web page that showed server status, the list of databases, replica-set state, and build details for a MongoDB instance running on port 27017. It was a convenience dashboard for older MongoDB versions. The feature was deprecated and removed in MongoDB 3.6, so you will only see it on outdated installations.
When would you open it?
There is no good reason to open this port today. The interface no longer exists in supported MongoDB versions, and even on old installs the recommendation is to disable it (--nohttpinterface) and upgrade. Use modern monitoring tools like MongoDB Compass or Ops Manager instead.
Is it safe to open?
The status page was usually unauthenticated and leaked details an attacker could use against the database, so keep it disabled and off the internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :28017
nmap -p 28017 <target>netstat -ano | findstr :28017
Test-NetConnection <host> -Port 28017lsof -i :28017
nmap -p 28017 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 28017 to your device's local IP, internal port 28017, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 28017/tcpsudo firewall-cmd --permanent --add-port=28017/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 28017 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 28017" -Direction Inbound -Protocol TCP -LocalPort 28017 -Action AllowSecurity & risks
Common attacks
- Information disclosure of databases, status, and server build details
- Reconnaissance to pivot to the main MongoDB port (27017)
- REST interface abuse to query data on versions where it is enabled
- Enumeration of replica set and operational metrics
Hardening
- Disable the HTTP status interface (--nohttpinterface) or upgrade past MongoDB 3.6
- Bind to localhost or a private interface; never expose 28017 to the internet
- Enable authentication on MongoDB and require TLS
- Firewall both 28017 and 27017 to trusted hosts
- Keep MongoDB patched and audit access
How to block this port
sudo ufw deny 28017/tcpsudo firewall-cmd --permanent --remove-port=28017/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 28017 -j DROPNew-NetFirewallRule -DisplayName "Block 28017" -Direction Inbound -Protocol TCP -LocalPort 28017 -Action Blocknmap snippet
nmap -p28017 --script mongodb-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What was port 28017 used for in MongoDB?
- 28017 served the legacy MongoDB HTTP status page, a web interface showing server status, databases, and build info. It was unauthenticated by default and removed in MongoDB 3.6, so it should be disabled and never exposed.
- Is port 28017 still a risk today?
- Only on legacy MongoDB installs that still run the HTTP interface. Where present, it leaks information useful for attacking the main 27017 port. Upgrade past 3.6 or disable the interface and firewall both ports.