Ports
The four ports of a node, which protocol they speak and who should reach each one.
| Port | Option | Protocol | Who reaches it |
|---|---|---|---|
| 27017 | --port | MongoDB wire protocol with TLS | Your applications, mongosh and the tools |
| 27100 | --peer-listen | Mutual TLS 1.3 between nodes | Only the other nodes |
| 27200 | --admin-listen | HTTPS: teseladb admin, /metrics and /healthz | Your operations team and your load balancers |
| 27080 | --http-port | HTTPS: REST API at /v1 and MCP at /mcp | Applications and agents that use HTTP |
What each one asks for
By default all four listen on 127.0.0.1. Change the addresses when deploying on several machines and give each client what its port asks for.
27017
TLS always. It asks for a user unless the node starts with --insecure.
27100
Only the other nodes, with a node certificate signed by the cluster CA. A machine without that certificate cannot open the connection.
27200
/healthz with no credentials; /metrics with a certificate of a user with clusterMonitor; the administration commands with clusterAdmin.
27080
Client certificate, OIDC token or API key. --http-port 0 turns it off.
See also
- Production checklist, with which ports to open to whom.
- TLS and certificates.