配置VPC防火墙的GCE实例无法远程连接MongoDB 27017端口

Let’s walk through the missing checks and fixes that might be causing your remote connection failure – I’ve tackled similar GCE + MongoDB setups before, so these are the most likely culprits:

1. Verify Firewall Rule Target Tags Are Applied to Your GCE Instance #

GCE firewall rules only work for instances with matching target tags. Even if you created the default-mongodb rule opening ports 27017, if your instance doesn’t have the corresponding tag (like mongodb, whatever you set in the firewall’s "Target tags" field), the rule won’t take effect.

• To fix this:
  1. Navigate to your GCE instance’s details page
  2. Under "Network tags", add the tag you specified in your firewall rule
  3. For quick debugging, temporarily set the firewall rule’s "Target" to "All instances in network" (not recommended for long-term production use, but great for confirming the tag was the issue)

2. Test Port Connectivity From Your Local Machine #

Before blaming MongoDB, confirm the port is actually reachable from outside GCE. Run these commands on your local machine:

# Using netcat
nc -zv <YOUR_GCE_IP> 27017

# Using telnet
telnet <YOUR_GCE_IP> 27017

• If these fail, the problem is definitely network/firewall-related (double-check your VPC ingress rules or go back to step 1)
• If they succeed, the issue lies with MongoDB configuration or client-server compatibility

3. Fix MongoDB Client-Server Version Compatibility #

Your server runs MongoDB 3.6.4, but your client is on 3.4.9. While 3.4 clients can theoretically connect to 3.6 servers, subtle protocol mismatches can cause handshake failures.

• Try either:
  1. Upgrade your local MongoDB client to 3.6.x (matching the server version is always the safest bet)
  2. Force the client to use the legacy protocol version when connecting:

     mongo my.ip.com:27017/database -u myusername -p --protocolVersion 0
     

     (3.4 clients default to protocol version 0, while 3.6 servers support both 0 and 1 – explicitly specifying it can resolve handshake issues)

4. Ensure MongoDB Service Restarted After Configuration Changes #

It’s easy to overlook, but any edits to mongod.conf require a service restart to take effect. Run this on your GCE instance:

# For systemd-based GCE images (most modern ones)
sudo systemctl restart mongod

# Verify the service is running correctly
sudo systemctl status mongod

Double-check that the bindIp: 0.0.0.0 setting is active by checking logs:

sudo tail -f /var/log/mongodb/mongod.log | grep "bindIp"

You should see a line like Listening on 0.0.0.0:27017 – if it shows 127.0.0.1, your configuration change didn’t apply.

5. Rule Out Local Network Restrictions #

Sometimes the problem isn’t on GCE, but on your local machine or network:

• Try connecting from a different network (e.g., your phone’s mobile hotspot) to rule out corporate firewalls, VPNs, or local antivirus software blocking port 27017
• Check your local machine’s firewall settings to ensure outgoing traffic to port 27017 is allowed

6. Confirm User Authentication Context #

While your error is a connection failure (not an authentication error), it’s worth verifying you’re using the correct authentication database. If your myusername was created in the admin database (common for superusers), you need to specify that when connecting:

mongo my.ip.com:27017/database -u myusername -p --authenticationDatabase admin

If you created the user directly in the database database, this step isn’t necessary, but it’s a quick check to eliminate edge cases.

内容的提问来源于stack exchange，提问作者Franz Noel