Securing Your MongoDB Instance with UFW: A Step-by-Step Guide

When running a MongoDB instance on your server, securing it against unauthorized access is essential. UFW (Uncomplicated Firewall) provides a simple yet effective way to manage your server’s firewall. This guide will walk you through setting up UFW on your server and configuring it to allow connections to your MongoDB instance only from a specific IP address. We’ll also cover how to handle the --network="host" option in Docker, which is often used for improved network performance.

Step 1: Update Your System

Before installing any new software, it’s a good idea to update your system’s package list. Run the following command to ensure your packages are up to date:

sudo apt update

Step 2: Install UFW

UFW might already be installed on your server, but if it’s not, you can install it with the following command:

sudo apt install ufw

This command will install UFW along with any necessary dependencies.

Step 3: Check the Existing Firewall Rules

Run sudo ufw status numbered before changing the firewall. Keep rules that other services depend on. If you are connected over SSH, allow the port you are using before enabling UFW. On a server using the default SSH port:

sudo ufw allow OpenSSH

Step 4: Allow Connections from a Specific IP Address

You can now configure UFW to allow connections to your MongoDB instance (which typically runs on port 27017) only from a specific IP address. Replace 203.0.113.10 with the IP address you want to allow:

sudo ufw allow from 203.0.113.10 to any port 27017 proto tcp

This rule ensures that only the specified IP address can connect to your MongoDB instance.

Step 5: Deny All Other Connections to MongoDB

To further secure your server, explicitly deny all other connections to port 27017:

sudo ufw deny 27017/tcp

Place this rule after the trusted address rule. Check for any earlier rule that already opens the port more broadly.

Inspect the Rules

sudo ufw status numbered

Step 6: Enable UFW

Finally, enable UFW to apply the rules you’ve configured. If UFW was already enabled, this step will ensure that your new rules are active:

sudo ufw enable

# Reload after editing UFW configuration files directly
sudo ufw reload

MongoDB in Docker

With --network host on Linux, the container shares the host network. Docker ignores published port flags in this mode, and the addresses MongoDB listens on are set by MongoDB’s own configuration. The example below keeps the original host-network setup.

docker run -d \
  --name mongodb \
  --network host \
  -v mongodbdata:/data/db \
  --env-file ./mongo.env \
  mongo

For a new data volume, set MONGO_INITDB_ROOT_USERNAME and MONGO_INITDB_ROOT_PASSWORD in the local environment file. Keep it out of source control. For an existing database, manage users through MongoDB. Use authentication and restrict the listener to the interfaces that need it.

If you publish a port from a Docker bridge network with -p, Docker can route that traffic before UFW sees it. Avoid publishing MongoDB publicly by default. If only containers on the same Docker network need it, keep the port unpublished.

Conclusion

Test the connection from the trusted address and from an address that should be blocked. Keep MongoDB authentication enabled even when a firewall restricts the port.