- Security >
- Network and Configuration Hardening >
- IP Binding
IP Binding¶
On this page
Overview¶
Starting in MongoDB 3.6, MongoDB binaries, mongod and
mongos, bind to localhost by default. If the
net.ipv6 configuration file setting or the --ipv6
command line option is set for the binary, the binary additionally binds
to the localhost IPv6 address.
Considerations¶
Warning
Make sure that your mongod and mongos
instances are only accessible on trusted networks. If your system
has more than one network interface, bind MongoDB programs to the
private or internal network interface.
To override and bind to other ip addresses, you can use the
net.bindIp configuration file setting or the
--bind_ip command-line option to specify a list of hostnames or ip
addresses.
Warning
Before binding to a non-localhost (e.g. publicly accessible) IP address, ensure you have secured your cluster from unauthorized access. For a complete list of security recommendations, see Security Checklist. At minimum, consider enabling authentication and hardening network infrastructure.
For example, the following mongod instance binds to both
the localhost and the hostname My-Example-Associated-Hostname, which is
associated with the ip address 198.51.100.1:
In order to connect to this instance, remote clients must specify
the hostname or its associated ip address 198.51.100.1:
To bind to all IPv4 addresses, you can specify the bind ip address of
0.0.0.0. To bind to all IPv4 and IPv6 addresses, you can specify
the bind ip address of ::,0.0.0.0 or alternatively, use the new
net.bindIpAll setting or the new command-line option
--bind_ip_all.
See also