MongoDB replicaset TLS/SSL - mongodb

Question

I have launched a MongoDB 4 replica-set on 3 servers by private IP successfully. Now I wanna bind another IP and it needs enabling TLS/SSL.
I have created PEMKeyFile and CAFile and copied these file s on all 3 servers and added the codes below to mongod.config file of all 3 servers.
# network interfaces
net:
port: 27017
bindIp: 10.10.20.21,5.22.25.45 # example private ip and one example valid IP
ssl:
mode: requireSSL
PEMKeyFile: /opt/mongo/mongo.pem
PEMKeyPassword: MyPassword
CAFile : /opt/mongo/CA.pem
allowInvalidCertificates: true
allowInvalidHostnames: true
security:
keyFile: /opt/mongo/mongo-keyfile
I got error
E STORAGE [initandlisten] Failed to set up listener: SocketException: Cannot assign requested address
I CONTROL [initandlisten] now exiting
I CONTROL [initandlisten] shutting down with code:48
What is wrong with it? How can I fix it?

Answer 1

should I see both of these IPs
yes, of course.
bindIp tells mongodb service which system network interfaces to listen on. These are local system interfaces, not the clients. As soon as mongobd bind to an interface, clients from anywhere can connect to this IP:
binding to 10.10.20.XXX : the private class A network interface allows clients to connect from any 10.XXX.XXX.XXX IP within the same network
binding to 5.22.25.XXX : the public network interface allows clients to connect from anywhere in the internet.
If you want to restrict access to mongodb and allow to connect from specific IPs/networks only, you need to enable authentication and apply the restriction to the user or a group: https://docs.mongodb.com/manual/reference/method/db.createUser/#authentication-restrictions.
E.g.
use admin
db.createUser(
{
user: "remote-client",
pwd: "password",
roles: [ { role: "readWrite", db: "reporting" } ],
authenticationRestrictions: [ {
clientSource: ["5.22.25.45"]
} ]
}
)
Will allow mongo -u remote-client -p password to connect from IP 5.22.25.45 only and permit reads and writes to/from "reporting" database.