Air-Gapping MongoDB in Production: Strict Firewall Whitelisting & Secure Payment Proxies in South Asia

1. The Open Port Hazard (0.0.0.0/0)

Automated internet-wide port scans constantly probe for MongoDB port 27017. Binding a database to '0.0.0.0' or relying solely on user/password authentication is an invitation for automated ransomware scripts.

On MoneTrix and SubsDrop, protecting customer credentials and transactions required an air-gapped private networking strategy.

2. Zero-Exposure UFW Firewall Configuration

We bound MongoDB strictly to internal interfaces and enforced kernel-level packet drops via UFW on all external interfaces.

Only our application server's static internal IP is permitted to open a TCP handshake on port 27017.

# Set default firewall policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow secure SSH access strictly on non-standard port
sudo ufw allow 22022/tcp comment "Hardened SSH"

# Whitelist database port exclusively from dedicated app server private IP
sudo ufw allow proto tcp from 10.0.1.15 to any port 27017 comment "App Server Only"

# Enable firewall and verify rule ordering
sudo ufw enable
sudo ufw status verbose

3. Hardened Payment Proxy & Cryptographic HMAC Verification

Local payment gateways (UddoktaPay, IT Pay BD, bKash) dispatch asynchronous webhooks upon customer payment completion. To protect our database from spoofed webhooks:

• Webhooks hit a dedicated isolated payment proxy endpoint.

• The proxy calculates a SHA-256 HMAC digest against the raw incoming payload and verifies it against the shared secret key.

• Replay attacks are prevented via mandatory timestamp validation (<5 minute drift) and transaction UUID idempotency checks using Redis SETNX locks.