Configure Windows netsh Firewall for MongoDB

On Windows Server systems, the netsh program provides methods for managing the Microsoft Windows Firewall. These firewall rules enable administrators to control which hosts can connect to the system, and limit risk exposure by limiting the hosts that can connect to a system.

The Windows Firewall processes rules in an order determined by rule type. Rules are parsed in the following order:

1. Windows service hardening 
2. Connection security
3. Authenticated bypass
4. Block
5. Allow
6. Default

By default, the policy in Windows Firewall allows all outbound connections, and blocks all incoming connections. 

Allow traffic from the BMC Digital Workplace  and Smart IT server to and from mongod.exe instances

This pattern is applicable to all mongod.exe instances running as stand-alone instances or as part of a replica set. The goal of this pattern is to explicitly allow traffic to the mongod.exe instance from the MyIT and Smart IT server.

netsh advfirewall firewall add rule name="Open mongod port 27017" dir=in action=allow protocol=TCP localport=27017

This rule allows all incoming traffic to port 27017, which allows the BMC Digital Workplace  and Smart IT server to connect to the mongod.exe instance.

Windows Firewall also allows enabling network access for an entire application rather than to a specific port, as in the following example:

netsh advfirewall firewall add rule name="Allowing mongod" dir=in action=allow program=" C:\mongodb\bin\mongod.exe"

Manage and maintain Windows Firewall configurations

This section contains a number of basic operations for managing and using netsh. While you can use the graphical interface to manage Windows Firewall, all core functionality is accessible from netsh.