Docs Home → MongoDB Manual

Configure Windows netsh Firewall for MongoDB为MongoDB配置Windows netsh防火墙

On this page本页内容

On Windows Server systems, the netsh program provides methods for managing the Windows Firewall. These firewall rules make it possible for administrators to control what hosts can connect to the system, and limit risk exposure by limiting the hosts that can connect to a system.在Windows Server系统上，netsh程序提供了管理Windows防火墙的方法。这些防火墙规则使管理员能够控制哪些主机可以连接到系统，并通过限制可以连接到一个系统的主机来限制风险暴露。

This document outlines basic Windows Firewall configurations. 本文档概述了Windows防火墙的基本配置。Use these approaches as a starting point for your larger networking organization. For a detailed over view of security practices and risk management for MongoDB, see Security.将这些方法作为大型网络组织的起点。有关MongoDB的安全实践和风险管理的详细概述，请参阅安全性。

Tip

See also: 另请参阅：

Windows Firewall documentation from Microsoft.Microsoft的Windows防火墙文档。

Overview概述

Windows Firewall processes rules in an ordered determined by rule type, and parsed in the following order:Windows防火墙按规则类型确定的顺序处理规则，并按以下顺序进行解析：

  1. Windows Service Hardening
  2. Connection security rules
  3. Authenticated Bypass Rules
  4. Block Rules
  5. Allow Rules
  6. Default Rules

By default, the policy in Windows Firewall allows all outbound connections and blocks all incoming connections.默认情况下，Windows防火墙中的策略允许所有出站连接并阻止所有传入连接。

Given the default ports of all MongoDB processes, you must configure networking rules that permit only required communication between your application and the appropriate mongod.exe and mongos.exe instances.给定所有MongoDB进程的默认端口，您必须配置仅允许应用程序与相应的mongod.exe和mongos.exe实例之间进行所需通信的网络规则。

The configuration changes outlined in this document will create rules which explicitly allow traffic from specific addresses and on specific ports, using a default policy that drops all traffic that is not explicitly allowed.本文档中概述的配置更改将创建明确允许来自特定地址和特定端口的流量的规则，使用默认策略删除所有不明确允许的流量。

You can configure the Windows Firewall with using the netsh command line tool or through a windows application. 您可以使用netsh命令行工具或通过Windows应用程序配置Windows防火墙。 On Windows Server 2008 this application is Windows Firewall With Advanced Security in Administrative Tools. 在Windows Server 2008上，此应用程序是管理工具中的具有高级安全性的Windows防火墙。On previous versions of Windows Server, access the Windows Firewall application in the System and Security control panel.在以前版本的Windows Server上，访问“系统和安全”控制面板中的Windows防火墙应用程序。

The procedures in this document use the netsh command line tool.本文档中的过程使用netsh命令行工具。

Patterns图案

This section contains a number of patterns and examples for configuring Windows Firewall for use with MongoDB deployments. 本节包含许多配置Windows防火墙以用于MongoDB部署的模式和示例。If you have configured different ports using the port configuration setting, you will need to modify the rules accordingly.如果使用端口配置设置配置了不同的port，则需要相应地修改规则。

Traffic to and from mongod.exe Instances往返于mongod.exe实例的流量

This pattern is applicable to all mongod.exe instances running as standalone instances or as part of a replica set. 此模式适用于作为独立实例或副本集的一部分运行的所有mongod.exe实例。The goal of this pattern is to explicitly allow traffic to the mongod.exe instance from the application server.此模式的目标是明确允许从应用程序服务器到mongod.exe实例的流量。

netsh advfirewall firewall add rule name="Open mongod port 27017" dir=in action=allow protocol=TCP localport=27017

This rule allows all incoming traffic to port 27017, which allows the application server to connect to the mongod.exe instance.该规则允许所有传入流量到端口27017，这允许应用程序服务器连接到mongod.exe实例。

Windows Firewall also allows enabling network access for an entire application rather than to a specific port, as in the following example:Windows防火墙还允许为整个应用程序而不是特定端口启用网络访问，如以下示例所示：

netsh advfirewall firewall add rule name="Allowing mongod" dir=in action=allow program=" C:\Program Files\MongoDB\Server\3.4\bin\mongod.exe"

You can allow all access for a mongos.exe server, with the following invocation:您可以通过以下调用来允许对mongos.exe服务器的所有访问：

netsh advfirewall firewall add rule name="Allowing mongos" dir=in action=allow program=" C:\Program Files\MongoDB\Server\3.4\bin\mongos.exe"

Traffic to and from mongos.exe Instances往返于mongos.exe实例的流量

mongos.exe instances provide query routing for sharded clusters. 实例为分片集群提供查询路由。Clients connect to mongos.exe instances, which behave from the client's perspective as mongod.exe instances. 客户端连接到mongos.exe实例，从客户端的角度来看，这些实例的行为与mongod.exe实例相同。In turn, the mongos.exe connects to all mongod.exe instances that are components of the sharded cluster.反过来，mongos.exe连接到作为分片集群组件的所有mongod.exe实例。

Use the same Windows Firewall command to allow traffic to and from these instances as you would from the mongod.exe instances that are members of the replica set.使用相同的Windows防火墙命令来允许与这些实例之间的通信，就像从作为副本集成员的mongod.exe实例进行通信一样。

netsh advfirewall firewall add rule name="Open mongod shard port 27018" dir=in action=allow protocol=TCP localport=27018

Traffic to and from a MongoDB Config Server往返于MongoDB配置服务器的流量

Configuration servers, host the config database that stores metadata for sharded clusters. Each production cluster has three configuration servers, initiated using the mongod --configsvr option. 配置服务器，托管用于存储分片集群元数据的config数据库。每个生产集群有三个配置服务器，使用mongod --configsvr选项启动。[1] Configuration servers listen for connections on port 27019. 配置服务器侦听端口27019上的连接。As a result, add the following Windows Firewall rules to the config server to allow incoming and outgoing connection on port 27019, for connection to the other config servers.因此，将以下Windows防火墙规则添加到配置服务器，以允许在端口27019上进行传入和传出连接，从而连接到其他配置服务器。

netsh advfirewall firewall add rule name="Open mongod config svr port 27019" dir=in action=allow protocol=TCP localport=27019

Additionally, config servers need to allow incoming connections from all of the mongos.exe instances in the cluster and all mongod.exe instances in the cluster. 此外，配置服务器需要允许来自集群中所有mongos.exe实例和集群中所有mongod.exe实例的传入连接。Add rules that resemble the following:添加类似于以下内容的规则：

netsh advfirewall firewall add rule name="Open mongod config svr inbound" dir=in action=allow protocol=TCP remoteip=<ip-address> localport=27019

Replace <ip-address> with the addresses of the mongos.exe instances and the shard mongod.exe instances.将<ip-address>替换为mongos.exe实例和分片mongod.exe实例的地址。

[1] You also can run a config server by using the configsvr value for the clusterRole setting in a configuration file.您还可以使用配置文件中clusterRole设置的configsvr值来运行配置服务器。

Traffic to and from a MongoDB Shard Server往返于MongoDB 分片服务器的流量

For shard servers, running as mongod --shardsvr [2] Because the default port number is 27018 when running with the shardsvr value for the clusterRole setting, you must configure the following Windows Firewall rules to allow traffic to and from each shard:对于分片服务器，以mongod --shardsvr [2]的身份运行。因为在使用clusterRole设置的shardsvr值运行时，默认端口号为27018，所以必须配置以下Windows防火墙规则，以允许流量进出每个分片：

netsh advfirewall firewall add rule name="Open mongod shardsvr inbound" dir=in action=allow protocol=TCP remoteip=<ip-address> localport=27018
netsh advfirewall firewall add rule name="Open mongod shardsvr outbound" dir=out action=allow protocol=TCP remoteip=<ip-address> localport=27018

Replace the <ip-address> specification with the IP address of all mongod.exe instances. 将<ip-address>规范替换为所有mongod.exe实例的ip地址。This allows you to permit incoming and outgoing traffic between all shards including constituent replica set members to:这允许您允许所有分片（包括组成副本集成员）之间的传入和传出流量：

Furthermore, shards need to be able make outgoing connections to:此外，分片需要能够建立到以下各项的传出连接：

Create a rule that resembles the following, and replace the <ip-address> with the address of the config servers and the mongos.exe instances:创建一个类似于以下内容的规则，并将<ip-address>替换为配置服务器和mongos.exe实例的地址：

netsh advfirewall firewall add rule name="Open mongod config svr outbound" dir=out action=allow protocol=TCP remoteip=<ip-address> localport=27018
[2] You can also specify the shard server option with the shardsvr value for the clusterRole setting in the configuration file. Shard members are also often conventional replica sets using the default port.您还可以在配置文件中为clusterRole设置指定带有shardsvr值的分片服务器选项。分片成员通常也是使用默认端口的传统复制集。
[3] All shards in a cluster need to be able to communicate with all other shards to facilitate chunk and balancing operations.集群中的所有分片都需要能够与所有其他分片通信，以促进区块和平衡操作。

Provide Access For Monitoring Systems为监控系统提供访问权限

The mongostat diagnostic tool, when running with the --discover needs to be able to reach all components of a cluster, including the config servers, the shard servers, and the mongos.exe instances.mongostat诊断工具在使用--discover运行时，需要能够访问集群的所有组件，包括配置服务器、分片服务器和mongos.exe实例。

Changed in version 3.6.3.6版更改。MongoDB 3.6 removes the deprecated HTTP interface and REST API to MongoDB.MongoDB 3.6删除了MongoDB中不推荐使用的HTTP接口和REST API。

Manage and Maintain Windows Firewall Configurations管理和维护Windows防火墙配置

This section contains a number of basic operations for managing and using netsh. While you can use the GUI front ends to manage the Windows Firewall, all core functionality is accessible is accessible from netsh.本节包含管理和使用netsh的一些基本操作。虽然您可以使用GUI前端来管理Windows防火墙，但所有核心功能都可以从netsh访问。

Delete all Windows Firewall Rules删除所有Windows防火墙规则

To delete the firewall rule allowing mongod.exe traffic:要删除允许mongod.exe流量的防火墙规则，请执行以下操作：

netsh advfirewall firewall delete rule name="Open mongod port 27017" protocol=tcp localport=27017

netsh advfirewall firewall delete rule name="Open mongod shard port 27018" protocol=tcp localport=27018

List All Windows Firewall Rules列出所有Windows防火墙规则

To return a list of all Windows Firewall rules:要返回所有Windows防火墙规则的列表，请执行以下操作：

netsh advfirewall firewall show rule name=all

Reset Windows Firewall重置Windows防火墙

To reset the Windows Firewall rules:要重置Windows防火墙规则，请执行以下操作：

netsh advfirewall reset

Backup and Restore Windows Firewall Rules备份和还原Windows防火墙规则

To simplify administration of larger collection of systems, you can export or import firewall systems from different servers) rules very easily on Windows:为了简化较大系统集合的管理，您可以在Windows上非常容易地从不同服务器导出或导入防火墙系统）规则：

Export all firewall rules with the following command:使用以下命令导出所有防火墙规则：

netsh advfirewall export "C:\temp\MongoDBfw.wfw"

Replace "C:\temp\MongoDBfw.wfw" with a path of your choosing. You can use a command in the following form to import a file created using this operation:将"C:\temp\MongoDBfw.wfw"”替换为您选择的路径。可以使用以下格式的命令导入使用此操作创建的文件：

netsh advfirewall import "C:\temp\MongoDBfw.wfw"