## rest 

The net.http.RESTInterfaceEnabled setting for mongod enables a fully interactive administrative REST interface, which is disabled by default. The net.http.RESTInterfaceEnabled configuration makes the http status interface $^{15}$, which is read-only by default, fully interactive. Use the net.http.RESTInterfaceEnabled setting with the enabled setting. 

The REST interface does not support any authentication and you should always restrict access to this interface to only allow trusted clients to connect to this port. 

You may also enable this interface on the command line as mongod --rest --httpinterface . 

Warning: Disable this option for production deployments. If do you leave this interface enabled, you should only allow trusted clients to access this port. 

## bind_ip 

The bindIp setting for mongod and mongos instances limits the network interfaces on which MongoDB programs will listen for incoming connections. You can also specify a number of interfaces by passing bindIp a comma separated list of IP addresses. You can use the mongod --bind_ip and mongos --bind_ip option on the command line at run time to limit the network accessibility of a MongoDB program. 

Important: Make sure that your mongod and mongos instances are only accessible on trusted networks. If your system has more than one network interface, bind MongoDB programs to the private or internal network interface. 

## port 

The port setting for mongod and mongos instances changes the main port on which the mongod or mongos instance listens for connections. The default port is 27017 . Changing the port does not meaningfully reduce risk or limit exposure. You may also specify this option on the command line as mongod --port or mongos --port . Setting port also indirectly sets the port for the HTTP status interface, which is always available on the port numbered 1000 greater than the primary mongod port. 

Only allow trusted clients to connect to the port for the mongod and mongos instances. See Firewalls (page 328). 

See also Security Considerations (page 194) and Default MongoDB Port (page 424). 

## Firewalls 

Firewalls allow administrators to filter and control access to a system by providing granular control over what network communications. For administrators of MongoDB, the following capabilities are important: limiting incoming traffic on a specific port to specific systems, and limiting incoming traffic from untrusted hosts. 

On Linux systems, the iptables interface provides access to the underlying netfilter firewall. On Windows systems, netsh command line interface provides access to the underlying Windows Firewall. For additional infor- mation about firewall configuration, see Configure Linux iptables Firewall for MongoDB (page 335) and Configure Windows netsh Firewall for MongoDB (page 339). 

For best results and to minimize overall exposure, ensure that only traffic from trusted sources can reach mongod and mongos instances and that the mongod and mongos instances can only connect to trusted outputs. 

See also: 

