Secure Remote Access for MongoDB: Setup Guide

This guide walks you through configuring secure remote access for MongoDB, covering TLS/SSL encryption, authentication, and firewall rules. It’s aimed at administrators who need to connect to a MongoDB instance from outside the local network without exposing data to risk.

What You’ll Need

A server running MongoDB (version 4.2 or later recommended).
Administrative access to the server (root or sudo).
A domain name or static IP for the server (optional but recommended for certificates).
OpenSSL installed on the server (usually pre-installed).
A firewall tool like ufw or iptables (if not already active).

Step-by-Step

Enable authentication in MongoDB.
Edit the MongoDB configuration file (typically /etc/mongod.conf). Under the security section, add:
```
security:
  authorization: enabled
```
This requires users to log in before accessing databases.
Create an administrative user.
Start the MongoDB shell locally (without authentication yet) using mongosh. Then create a user with the root role:
```
use admin
db.createUser({
  user: "admin",
  pwd: "your_strong_password",
  roles: [ { role: "root", db: "admin" } ]
})
```
Replace your_strong_password with a long, random password.
Generate a self-signed certificate (or obtain one from a CA).
Use OpenSSL to create a self-signed certificate for testing, or better, get a certificate from a trusted CA for production. For self-signed:
```
openssl req -newkey rsa:2048 -nodes -keyout mongodb.key -x509 -days 365 -out mongodb.crt
```
Then combine the key and certificate into a single PEM file:
```
cat mongodb.key mongodb.crt > mongodb.pem
```
Place this file in a secure location, e.g., /etc/ssl/mongodb.pem.
Configure MongoDB to use TLS/SSL.
In the same config file, add a net.tls section:
```
net:
  port: 27017
  bindIp: 0.0.0.0
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
```
Setting bindIp to 0.0.0.0 allows remote connections; ensure your firewall restricts access appropriately.
Restart MongoDB.
Run sudo systemctl restart mongod (or the equivalent for your OS). Check the logs to ensure it starts without errors.
Configure the firewall.
Allow only your IP (or a specific range) to access port 27017. For example, with ufw:
```
sudo ufw allow from 203.0.113.5 to any port 27017
```
Replace 203.0.113.5 with your client’s public IP. Do not open the port to the world.
Test the connection from a remote client.
Use the MongoDB shell with TLS and authentication:
```
mongosh "mongodb://admin:your_strong_password@server_ip:27017/admin?tls=true"
```
If you used a self-signed certificate, add tlsAllowInvalidCertificates=true for testing, but remove it in production.

Common Mistakes

Leaving bindIp as 127.0.0.1 – this only allows local connections.
Using a weak password or reusing the default admin credentials.
Forgetting to enable authentication before exposing the port – this leaves the database completely open.
Placing the PEM file in a world-readable location – anyone on the server can steal the private key.
Opening port 27017 to all IPs (0.0.0.0/0) in the firewall.
Not testing the connection from outside before relying on it.

Tips

Use a certificate from a trusted CA (like Let’s Encrypt) instead of self-signed for production to avoid client warnings and potential man-in-the-middle attacks.
Consider using SSH tunneling as an additional layer: ssh -L 27017:localhost:27017 user@server then connect to localhost:27017.
Enable MongoDB’s built-in auditing (if available in your edition) to track access.
Use a dedicated non-root user for MongoDB, not the system root.
Set up a VPN (like WireGuard or OpenVPN) and only allow connections from the VPN subnet.
Regularly update MongoDB and the operating system to patch vulnerabilities.

Troubleshooting

Cannot connect from remote client. Check that the MongoDB process is listening on all interfaces (netstat -tulpn | grep 27017). Verify the firewall allows your IP. Test with telnet server_ip 27017 to see if the port is reachable.
TLS handshake fails. Ensure the PEM file contains both the private key and certificate, in that order. Check file permissions (should be readable by the mongod user). Try generating a new certificate with the correct hostname.
Authentication fails. Confirm the user exists and the password is correct. Remember that the root user is in the admin database; specify ?authSource=admin in the connection string. Check MongoDB logs for errors like “Authentication failed”.
MongoDB doesn’t start after config changes. Run sudo mongod --config /etc/mongod.conf to see the error output. Common issues: YAML syntax errors, missing certificate file, or wrong file permissions.
Slow remote connections. This could be due to network latency or lack of compression. Enable compression in the connection string: ?compressors=snappy.

Frequently Asked Questions

Is it safe to expose MongoDB directly to the internet?

Generally, no. Even with TLS and authentication, MongoDB has been targeted by ransomware. It’s safer to use a VPN or SSH tunnel. If you must expose it, use strong passwords, IP whitelisting, and monitor logs.

Can I use a self-signed certificate in production?

Technically yes, but clients will need to trust it manually. This can be inconvenient and less secure if not done properly. A free certificate from Let’s Encrypt is a better choice.

How do I change the MongoDB port from 27017?

Edit the net.port in the config file and restart MongoDB. Ensure your firewall and connection strings use the new port.

What does `bindIp: 0.0.0.0` do?

It tells MongoDB to listen on all network interfaces, allowing connections from any IP. This is required for remote access, but you must combine it with firewall rules to restrict who can connect.

How do I revoke remote access for a user?

Delete the user or change their password. Also update firewall rules to block their IP. To completely disable remote access, set bindIp back to 127.0.0.1 and restart MongoDB.

What if I forget the admin password?

You’ll need to stop MongoDB, start it without authentication (temporarily), reset the password, and re-enable authentication. This should be done carefully, ideally during maintenance.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →