Restricting network access using firewalls

In this recipe, we will take a quick look at how to use Linux IPTables to add firewall rules that can restrict unwanted access to MongoDB processes.

Getting ready

You need standard MongoDB binaries on a Linux operating system. We are going to use Uncomplicated Firewall (UFW) tools, which is a handy wrapper built on top of IPTables. We assume that you have a three-node replica set running on the following hosts:

Hostname	IP
server1.foo.com	10.1.1.1
server2.foo.com	10.1.1.2
server3.foo.com	10.1.1.3

How to do it...

1. Most Linux distributions come with a kernel that supports net filters, the network filter API on top of which IPTables is built. We will install UFW, a set of tools that help simplify IPTables configuration:

apt-get install ufw

2. Enable the UFW service:

ufw enable

3. Add the firewall rules to allow all traffic on port 27017 from known IPs:

ufw allow from 10.1.1.1 to any port 27017
ufw allow from 10.1.1.2 to any port 27017
ufw allow from 10.1.1.3 to any port 27017...