- Security >
- Firewall Configuration
Firewall Configuration¶
On this page
- Open Ports to Access Ops Manager
- Open Ports to Access Ops Manager and MongoDB Hosts
- Open Ports to Back Up, Restore, and Query MongoDB Instances using Ops Manager
- Open Ports to Integrate Ops Manager with SNMP
- Open Ports to Provide Additional Monitoring for Ops Manager
- Open Ports to Authenticate Ops Manager Users using LDAP
- Open Ports to Authenticate with MongoDB
- Open Ports to Manage Encryption Keys using KMIP
- Internet Site Access
Ops Manager connects with a number of services. This page explains the ports that must be opened to deploy the various components used with an Ops Manager deployment.
The specific ports that must be open on any intermediate firewalls depend upon what capabilities are enabled, such as encryption, authentication, and monitoring.
Tip
All ports listed in the following sections are either the port specified in the documentation for MongoDB installations or the known ports for the specific service assigned by the IANA. If the port number can be changed, it is noted after the table in each section.
To run Ops Manager without an Internet connection, see Configure Deployment to Have Limited Internet Access to ensure you have all of the necessary binaries to run Ops Manager without an Internet connection.
Open Ports to Access Ops Manager¶
Ops Manager requires the following minimum network port requirements:
- Both Ops Manager users and Ops Manager agents must be able to connect to the Ops Manager application over HTTP or HTTPS.
- Ops Manager must be able to connect to the mongod running the Ops Manager application MongoDB databases.
- For each Ops Manager project, Ops Manager agents must be able to connect
to all client MongoDB processes (
mongod
ormongos
). - The Ops Manager application must also be able to send email to Ops Manager users.
To use Ops Manager, open the following ports to the specified servers.
Service | Default Port | Transport | Direction | Purpose | Uses SSL? |
---|---|---|---|---|---|
HTTP | 8080 | TCP | Inbound | Provides a web connection to Ops Manager from users and Ops Manager agents. | No |
HTTPS | 8443 | TCP | Inbound | Provides a secure web connection to Ops Manager from users and Ops Manager agents. | Yes |
HTTP or HTTPS | 8090 | TCP | Inbound | Provides a health-check endpoint for monitoring Ops Manager
through a monitoring service like Zabbix or Nagios. It is
only available through To enable it, see Enable the Health Check Endpoint. When enabled, you can access the endpoint at: Important This port is only accessible from The API endpoint provides the ability to check connections from the HTTP Service to the Ops Manager Application Database and the Backup Snapshot Storage. A successful response returns the following: |
Optional |
MongoDB | 27017 | TCP | Outbound | Connects to MongoDB application, backup and client databases. | Optional |
SMTP | 587 | TCP | Outbound | Sends emails from Ops Manager to an SMTP server or to AWS SES. | Optional |
Note
- To set a non-default port for Ops Manager, see Manage Ops Manager Ports.
- To configure a different port for the application database, see
mongo.mongoUri
. - To configure a different port for a client database, see Deploy a Standalone MongoDB Instance, Deploy a Replica Set, or Deploy a Sharded Cluster for a new deployment or Add Existing MongoDB Processes to Ops Manager for an existing deployment.
Open Ports to Access Ops Manager and MongoDB Hosts¶
Most Ops Manager administration can be performed through the user interface. Some procedures require access to the operating system. To permit your administrators to access your Ops Manager as well as MongoDB hosts, open the following ports to those hosts.
Service | Default Port | Transport | Direction | Purpose | Uses SSL? |
---|---|---|---|---|---|
ssh | 22 | TCP | Inbound | Linux System administration. | Yes |
RDP | 3389 | TCP | Inbound | Windows System administration. | No |
Open Ports to Back Up, Restore, and Query MongoDB Instances using Ops Manager¶
Ops Manager can back up MongoDB databases to one or more storage systems: a MongoDB database (blockstore), an S3 bucket (S3 blockstore) or a file system (file system store). To back up MongoDB servers, open the following ports to the preferred backup hosts (blockstore, S3 snapshot store and/or file system snapshot store):
Service | Default Port | Transport | Direction | Purpose | Uses SSL? |
---|---|---|---|---|---|
MongoDB | 27017 | TCP | Outbound | Back up snapshots of entire database to Blockstore or snapshot metadata to S3 Blockstore metadata database. | Optional |
HTTPS | 443 | TCP | Outbound | Back up database snapshot data to S3 bucket. | Yes |
NFS | 2049 | TCP | Outbound | Back up database snapshots to UNIX-/Linux-based file system. | No |
CIFS | 3020 | TCP | Outbound | Back up database snapshots to Windows-based file system. | No |
scp | 22 | TCP | Outbound | Restore snapshot to a server. | Yes |
Snapshots can also be restored using the link displayed in the Ops Manager application. The same ports needed to use Ops Manager would need to be open for the user to download the snapshot.
To find the download link, click Backup, then the Restore History tab, then click the download link next to the snapshot.
Note
- To configure a different port for the Blockstore, see Manage Blockstore Snapshot Storage.
- To configure a different port for the S3 Snapshot Store metadata database, see Manage S3 Blockstore Snapshot Storage.
MongoDB 3.4.2 Enterprise and later provides the ability to query backup snapshots. Ops Manager provisions these queryable snapshots as read-only MongoDB instances, as described in Query a Backup. To query a backup snapshot, open the following ports:
Service | Default Port | Transport | Direction | Purpose | Uses SSL? |
---|---|---|---|---|---|
MongoDB | 27700-27719 | TCP | Inbound | Enable communication between the app server and a queryable backup snapshot. | Optional |
Open Ports to Integrate Ops Manager with SNMP¶
Open the following ports between Ops Manager and your SNMP Manager to send and receive SNMP trap notifications from your MongoDB deployments to Ops Manager.
Service | Default Port | Transport | Direction | Purpose | Uses SSL? |
---|---|---|---|---|---|
SNMP | 162 | UDP | Outbound | Send Traps to SNMP Manager. | No |
SNMP | 11611 | UDP | Inbound | Receive requests from SNMP Manager. | No |
Ops Manager uses SNMP v2c. You can configure the Ops Manager Application to send a periodic heartbeat trap notification (v2c) that contains an internal health assessment of the Ops Manager Application. The Ops Manager Application can send traps to one or more endpoints on the standard SNMP UDP port 162.
To configure the Ops Manager Application to send trap notifications, first download the Management Information Base (MIB) file at http://downloads.mongodb.com/on-prem-monitoring/MMS-MONGODB-MIB.txt . Then add the following settings as custom settings. To do so, click the Admin link, then the General tab, then the Ops Manager Config page, and then the Custom section.
Open Ports to Provide Additional Monitoring for Ops Manager¶
Important
As of Automation Agent 2.7.0, using Munin to monitor hardware has been deprecated in favor of the native cross-platform hardware monitoring available to managed deployments through the Automation Agent.
Beyond Ops Manager’s built-in monitoring capability, it can use the Munin Graphing Framework to provide additional monitoring on UNIX/Linux-based MongoDB instances and hosts.
Service | Default Port | Transport | Direction | Purpose | Uses SSL? |
---|---|---|---|---|---|
munin-node | 4949 | TCP | Inbound | Provides CPU and disk throughput and latency metrics. | No |
To configure the munin-node
package, see
Configure Hardware Monitoring with munin-node.
Open Ports to Authenticate Ops Manager Users using LDAP¶
MongoDB Enterprise users can authenticate Ops Manager users using LDAP. To authenticate using LDAP, open the following ports on Ops Manager and your LDAP server.
Service | Default Port | Transport | Direction | Purpose | Uses SSL? |
---|---|---|---|---|---|
LDAP | 389 | UDP | Both | Authenticate and/or authorize Ops Manager users against LDAP server. | No |
LDAPS | 636 | UDP | Both | Authenticate and/or authorize Ops Manager users against LDAP server. | Yes |
To configure the Ops Manager LDAP URI strings, including configuring a non-standard port, see User Authentication.
Open Ports to Authenticate with MongoDB¶
MongoDB Enterprise users can use Kerberos or LDAP to authenticate MongoDB users. To authenticate using LDAP or Kerberos, open the following ports between the MongoDB client databases, Ops Manager, and the Kerberos or LDAP server(s).
Service | Default Port | Transport | Direction | Purpose | Uses SSL? |
---|---|---|---|---|---|
Kerberos | 88 | TCP / UDP | Outbound | Request authentication for MongoDB users against Kerberos server. | No |
Kerberos | 88 | UDP | Inbound | Receive authentication for MongoDB users against Kerberos server. | No |
LDAP | 389 | UDP | Both | Authenticate and/or authorize MongoDB users against LDAP server. | No |
LDAPS | 636 | UDP | Both | Authenticate and/or authorize MongoDB users against LDAP server. | Yes |
To configure Kerberos for authentication to the Ops Manager application database, see Configure Ops Manager to Connect to Backing Databases with Access Control.
Open Ports to Manage Encryption Keys using KMIP¶
MongoDB Enterprise deployments using the WiredTiger storage engine supports a native encryption option. You can use a KMIP service to manage the master encryption key. To support the encrypted storage engine via KMIP, open the following ports between the Backup Daemon hosts, the MongoDB hosts, and the KMIP hosts.
Service | Default Ports | Transport | Direction | Purpose | Uses SSL? |
---|---|---|---|---|---|
KMIP | 5696 | TCP | Outbound | Send messages between MongoDB databases and KMIP host. | Yes |
Note
If you change the port for the KMIP server, see Encrypted Backup Snapshots to configure Ops Manager to use that new port.
Internet Site Access¶
If Ops Manager is not configured for Local Mode, it requires access to the following Internet sites over HTTPS:
Site | Purpose |
---|---|
downloads.mongodb.com | To download MongoDB Enterprise Builds. |
opsmanager.mongodb.com | To download the MongoDB version manifest. |
fastdl.mongodb.org | To download MongoDB Community Builds. |