Configuring Network Security
1. Enabling TLS/SSL
net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongo.pem
CAFile: /etc/ssl/ca.pem2. Configuring TLS Certificates
| File | Detail |
|---|---|
| certificateKeyFile | Server cert + key |
| CAFile | Trusted CA chain |
| clusterFile | Cert for intra-cluster auth |
3. Setting Client TLS Options
| Option | Detail |
|---|---|
| tls=true | Connection string |
| tlsCAFile | Verify server |
| tlsAllowInvalidHostnames | Bypass hostname check (avoid in prod) |
4. Using IP Whitelisting
| Where | Detail |
|---|---|
| mongod | net.bindIp restricts interfaces |
| Atlas | IP Access List per project |
5. Configuring Firewall Rules
| Port | Use |
|---|---|
| 27017 | mongod / mongos |
| 27018 | Shard nodes |
| 27019 | Config servers |
6. Setting Up SSH Tunneling
ssh -L 27017:db.internal:27017 user@bastion7. Using VPC Peering
| Aspect | Detail |
|---|---|
| Atlas | AWS/GCP/Azure VPC peering supported |
| Benefit | Private routing without internet |
8. Implementing Private Endpoints
| Provider | Service |
|---|---|
| AWS | PrivateLink |
| Azure | Private Link |
| GCP | Private Service Connect |
9. Configuring Network Compression
| Option | Algorithms |
|---|---|
| networkMessageCompressors | snappy, zlib, zstd |
| Connection string | compressors=zstd,snappy |
10. Understanding Network Security Best Practices
| Practice | Detail |
|---|---|
| Always TLS | requireTLS in production |
| No public bind | Bind to internal interfaces only |
| Rotate certs | Periodic rotation, monitor expiry |
| Separate auth DB | Use external IdP (LDAP/x.509) |