Connection timeout over VPN, unable to access the service

Michal_Mach · 2023-02-27T07:29:36.244Z

How can I enable access to database through my private VPN?
I don’t want to disable VPN every time I want yo use your services, which is a lot of downtime for my VPN secured connection.
I rly cannot youse your services for development and I am considering alternatives…

Andrew_Davidson · 2023-03-03T16:52:08.388Z

Hi Michal,

Generally speaking if you wish you connect via a VPN you will want to either transitively connect via an AWS DirectConnect or Azure ExpressRoute through an Atlas Private Endpoint or if your VPN is more of a stand-alone set-up, you would want to add the public IP address of whatever your VPN reaches out to the public internet with to your Atlas IP Access List

Let us know if that helps
-Andrew

Michal_Mach · 2023-03-07T06:14:31.236Z

Hi Andrew,

Thank you for response. I’m using proton VPN, I’ve allowed 0.0.0.0/0 IP address, this is not a problem. The problem is that I receive timeouts though VPN and can not connect at all.
For now I’m using docker mongo cluster locally, and I’m seriously considering using my own setup for dev and prod environments instead of atlas because of this.

Regards,
Mike

steevej · 2023-03-07T13:55:40.654Z

Please cut-n-paste the exact error message that you get.

Michal_Mach · 2023-03-08T04:47:18.654Z

Just a timeout.
The same command works without VPN in multiple locations (IPs)

mongosh "mongodb+srv://cluster0.ibXXXX.mongodb.net/test" --apiVersion 1 --username MY_USERNAME
Enter password: ****************
Current Mongosh Log ID:	640XXXXXXXXXXXXX
Connecting to:		mongodb+srv://<credentials>@cluster0.ibXXXX.mongodb.net/test?appName=mongosh+1.7.1
MongoServerSelectionError: Server selection timed out after 30000 ms

steevej · 2023-03-10T01:27:09.127Z

I would contact the VPN provider.

But before try to enforce the VPN to use Google’s DNS 8.8.8.8 and/or 8.8.4.4.

Tal_Jacob_Sir_Jacques · 2023-04-15T12:33:11.927Z

Hi I was having this issue too (I am actually also using ProtonVPN), and I got the answer.

When connecting to mongodb Atlas, we can see that mongodb Atlas opens dynamic ports in our local machine in order to communicate.

image900×470 62.2 KB

In the screenshot, you can see that the servers in mongodb Atlas that opened the 27017 ports, are opening dynamic ports to our local machine (i.e. 10.0.0.102) that are probably necessary for communication.

In our case, it is known that ProtonVPN is blocking all ports through their firewall by default, thus they are not allowing mongodb Atlas to open the dynamic ports it wants for establishing the communication. And this results with a connection timeout, and a failure.

So unfortunately, because there is no option for ProtonVPN to open dynamic ports, there is no option to connect to mongodb Atlas through ProtonVPN.

atineoSE · 2023-04-15T15:31:53.207Z

I’m having the same issue, also connecting with ProtonVPN. Is there anything that can be done to workaround this @Andrew_Davidson?

steevej · 2023-04-17T13:00:26.353Z

Tal_Jacob_Sir_Jacques:

open dynamic ports

All the above text about have to open dynamic ports to established an outgoing connection to port 27017 shows a lack of networking knowledge. The port that needs to be open is 27017. Do the same netstat/findstr with https. You will see a bunch of 10.* dynamic port ESTABLISHED to what ever IP:https web site you have. ProtonVPN does not open each and everyone of what you call dynamic port, it opens https.

So

steevej:

I would contact the VPN provider.

The issue is the VPN provider. It is not a mongodb issue.

atineoSE · 2023-04-19T09:47:11.511Z

I got the following from ProtonVPN support on the issue:

Please be informed that outgoing connections to some database-related ports are currently being blocked on most of our servers for anti-abuse reasons, so this could be the reason you are experiencing such an issue. Normally, any user connected to the same ProtonVPN server would have the same authorization to access the database you are willing to connect to unless there are additional security measures in place, so this is not recommended and is insecure. Even if you whitelist some ProtonVPN IP addresses with your firewall, that is still not enough because any user would still be able to reach your database through the very same ProtonVPN IP address.

steevej · 2023-04-19T13:24:45.600Z

So they basically tell you to use another VPN provider or not to use their VPN to access your database.

While it is absolutely true that anyone using the same VPN exit point that is white listed will be able to access your database, they will only be able to do it if they have the appropriate credentials. That is

atineoSE:

unless there are additional security measures in place, so this is not recommended and is insecure

But since they won’t accommodate you despite the fact that MongoDB has additional security measures.

Conclusion

steevej:

The issue is the VPN provider. It is not a MongoDB issue.

atineoSE · 2023-04-19T15:14:02.811Z

This really looks like a dead-end, as it looks like it’s not possible to change the default port of an Atlas cluster

It’s either change VPN provider, or DB provider, or manage deployment in a self-managed instance where one could change the DB ports, any of which is painful enough.

steevej · 2023-04-19T16:37:36.612Z

atineoSE:

change …, or DB provider

Why do you think that it would work? What you share with us is clear:

atineoSE:

outgoing connections to some database-related ports are currently being blocked on most of our servers for anti-abuse reasons

Why would you think they block MongoDB port and not other DB provider?

By

atineoSE:

blocked on most of our servers

I understand that some of their servers are not blocked and will let you connect. May be you can try that before changing VPN or DB.

By

atineoSE:

blocked … for anti-abuse reasons

I understand that rather than trying to take care of the abusers, they prefer to block all legitimate users. The sad part is that they do not seem to be inclined to help you.

But networking wise, can’t you simply create a different IP route that bypass your VPN for what ever IP network your cluster is using?

Andy_Tran2 · 2024-12-23T12:49:42.108Z

I am encountering a connection timeout issue (30000ms) with both Studio 3T and MongoDB Compass when trying to connect to our MongoDB Atlas. It was working fine before I performed a system update. I’m using Perimeter81 VPN. Is there anything that can be done to workaround this ?

I_Gusti_Ngurah_Oka_Prinarjaya · 2025-04-30T08:37:27.995Z

Hi! I use DigitalOcean’s Managed MongoDB. and I use Pritunl VPN Server, I solve this issue by adding a route 0.0.0.0/0 in my Pritunl VPN Server as you can see in screenshoot

Screenshot 2025-04-30 0002481446×849 34.5 KB

Hope it helps