MongoDB Wire Protocol Guard (mongodb)
The MongoDB Protocol Guard plugin intercepts native MongoDB wire protocol messages (OP_MSG and legacy OP_QUERY). It enforces command policy restrictions directly on the wire, blocking catastrophic commands (dropDatabase, drop, shutdown) and tracking authentication error responses (error code 18 AuthenticationFailed) to eliminate credential brute-forcing attacks.
Capabilities & Threat Defense
| Threat / Attack Vector | Defense Mechanism | Action Taken |
|---|---|---|
| Accidental or Malicious Database Drop | Filters wire commands against blocked_ops | Command rejected with synthetic error before reaching mongod |
| Credential Stuffing | Tracks AuthenticationFailed (code 18) responses | Abusive IP banned after threshold |
| Server Shutdown Exploits | Blocks shutdown administrative command | Blocked at proxy layer |
| Connection Flooding | Enforces IP connection velocity limits | Excess connection attempts dropped |
Installation
Install the plugin via CLI or declaratively:
# Install using short nametcp-warden plugins install mongodb# Or install via Git repository URLtcp-warden plugins install https://github.com/routewarden/plugins/mongodbConfiguration Reference
Add a MongoDB guard service to tcp-warden.yaml:
services: mongo_bastion: listen: ":27017" upstream: "127.0.0.1:270170" protocol: "mongodb" rate_limit: connections_per_minute: 60 burst: 10 max_auth_failures: 3 ban_after_failures: 3 ban_duration: "2h" plugin_config: blocked_ops: - "dropDatabase" - "drop" - "shutdown" - "repairDatabase"Configuration Options
| Field | Type | Default | Description |
|---|---|---|---|
listen | string | ":27017" | Local proxy listen address and port. |
upstream | string | "127.0.0.1:270170" | Target mongod instance address and port. |
protocol | string | "mongodb" | Must be set to "mongodb" or "mongo". |
max_auth_failures | int | 3 | Number of failed authentication attempts before banning. |
ban_duration | string | "2h" | Ban duration for offending IPs ("30m", "2h", "24h"). |
plugin_config.blocked_ops | []string | ["dropDatabase", ...] | MongoDB operation names blocked by the wire filter. |
Network & Deployment Architecture
Because MongoDB operates on an unprivileged port (27017), firewall redirection rules (nftables/iptables) are not required. Deploy RouteWarden using either direct reverse proxying or container network isolation:
Option A: Direct Reverse Proxy (Bare-Metal / VM)
Bind RouteWarden to :27017, and run mongod on an internal loopback port or private subnet IP:
# tcp-warden.yaml — RouteWarden binds to standard MongoDB port 27017services: mongo_bastion: listen: ":27017" upstream: "127.0.0.1:270170" # Or private host "10.0.0.25:27017" protocol: "mongodb"Option B: Docker Compose Network Isolation
Publish port 27017 on RouteWarden while keeping the MongoDB container completely private:
services: routewarden: image: ghcr.io/routewarden/tcp-warden:latest ports: - "27017:27017" - "9091:9091" volumes: - ./tcp-warden.yaml:/etc/routewarden/tcp-warden.yaml:ro depends_on: - mongo mongo: image: mongo:7.0 environment: MONGO_INITDB_ROOT_USERNAME: admin MONGO_INITDB_ROOT_PASSWORD: secretpassword # Do NOT publish host ports; keep internal to bridge networkTesting & Verification
Verify queries, test blocked operations, and simulate authentication failures:
# Verify legitimate querymongosh --port 27017 --eval "db.serverStatus()"