DigitalOcean Setup using private IPs - SocketException: Cannot assign requested address

Ops and Admin
,
1

Hello MongoDB people,

I am currently setting up a fresh mongoDB deployment on Digital Ocean. I have 2 droplets:

  • prod-master droplet running my nodeJS app inside docker containers - private IP of the droplet: 1.2.5.10
  • prod-mongodb running only the mongoDB instance - private IP of the droplet: 1.2.5.11
    (don’t worry - despite the name these 2 droplets are not yet in production! :wink:)

Both droplets are in the same DO region, both droplets are in the same (standard/default) VPC of the DigitalOcean region, both have private IPs, both can ping the other one via the private IP!

Until now, I was running a bindIp: 0.0.0.0 setup in my /etc/mongod.conf and everything was fine. Now I want to secure this setup for going live.

If I understand bindIp correctly I would now change it to bindIp: localhost,1.2.5.10 to only allow the prod-mongodb droplet itself (= localhost) and my other main droplet (= 1.2.5.10) to access my mongo DB. correct?

When I try this my mongod service can’t start up anymore and I end up with the following error:

"error":{"code":9001,"codeName":"SocketException","errmsg":"Cannot assign requested address"}

I now have read so many tutorials and stuff and I really can’t find any clues on what I am doing wrong! Please help me out here!

Thanks a bunch, best regards
Patrick

2

Welcome to the MongoDB community @Patrick_Schubert!

The bindIP directive determines which local network interfaces the MongoDB process listens to, not the specific remote addresses that are allowed to connect.

The “Cannot assign requested address” error indicates you are trying to bind to an address that is not a local network interface for that droplet.

The only valid values for bindIp are local network interfaces for the MongoDB process. For example, on Linux any local IPs would appear in the output of ifconfig -a | grep "inet".

If prod-mongodb has 1.2.5.11 as a local network interface, you could bind to 127.0.0.1,1.2.5.11.

To limit remote connections to those originating from 1.2.5.10 you need to configure appropriate firewall settings. See Network Hardening and the MongoDB Security Checklist for more details.

Regards,
Stennie