MongoDB "connect ECONNREFUSED 127.0.0.1:27017": Causes and Fixes

ECONNREFUSED on port 27017 means your driver tried to open a TCP connection to the MongoDB port and the target answered that nothing is listening. The driver then reports it as a server selection failure after its timeout, so the message you see is often wrapped:

MongooseServerSelectionError: connect ECONNREFUSED 127.0.0.1:27017
MongoServerSelectionError: connect ECONNREFUSED ::1:27017
MongoNetworkError: failed to connect to server [localhost:27017] on first connect

If instead the message says the server could not be selected within 30 seconds and lists unreachable hosts without ECONNREFUSED, read MongoDB server selection timeout. Refused is the easier case, because the address is reachable and just closed.

Step 1: is mongod running?

sudo systemctl status mongod
mongosh --eval 'db.runCommand({ ping: 1 })'
sudo ss -tlnp | grep 27017

If the service is down, start it with sudo systemctl start mongod, then read why it died:

sudo journalctl -u mongod -n 50 --no-pager
sudo tail -n 50 /var/log/mongodb/mongod.log

Frequent startup failures: a data directory (/var/lib/mongodb) with the wrong owner, a full disk, a bad mongod.conf indentation (it is YAML), or a stale socket file /tmp/mongodb-27017.sock owned by another user after running mongod as root once. Fix ownership with sudo chown -R mongodb:mongodb /var/lib/mongodb /var/log/mongodb, and remove a stale socket file only after confirming no mongod process is running. Package and path names can differ by distribution and install method, so check yours.

Step 2: the ::1 versus 127.0.0.1 trap

This catches many Node.js developers. In Node.js 17 and later, localhost is resolved in the order the operating system returns it, which can be the IPv6 address ::1 first. If MongoDB listens only on IPv4 127.0.0.1, a connection string with localhost fails with ECONNREFUSED ::1:27017, even though mongod is healthy.

Fixes, in order of preference:

1. Use 127.0.0.1 in the connection string: mongodb://127.0.0.1:27017/mydb.
2. Make MongoDB listen on IPv6 too: net.bindIp: 127.0.0.1,::1 and, if required, net.ipv6: true in mongod.conf. Check the current MongoDB docs for exact behavior in your version.
3. As a Node-level option, node --dns-result-order=ipv4first app.js makes IPv4 results come first.

Step 3: check bindIp and the port

## /etc/mongod.conf
net:
  port: 27017
  bindIp: 127.0.0.1

The default bindIp limits connections to the local machine. To accept connections from other hosts, add the server's private address, for example bindIp: 127.0.0.1,10.0.0.5, then restart. Avoid 0.0.0.0 unless a firewall restricts access. Enable authentication (security.authorization: enabled) before exposing the port to any network, because an open, unauthenticated database is a well-known way to lose data.

Check that your connection string port matches; Atlas and other hosted services use mongodb+srv:// URIs, which need DNS SRV lookups rather than a fixed port. Test the SRV record with the DNS Checker if you suspect DNS.

Step 4: Docker, Compose and Kubernetes

As with Redis and any other service, localhost in a container refers to that container.

• In Docker Compose, connect to the service name: mongodb://mongo:27017/mydb, and wait for the database to be healthy before the app starts, using a healthcheck and depends_on with condition: service_healthy.
• If the app runs on the host and MongoDB in a container, publish the port with -p 27017:27017 and connect to 127.0.0.1.
• If MongoDB runs on the host and the app in a container, use host.docker.internal (Docker Desktop) or the host gateway, and bind MongoDB to an address the container can reach.
• In Kubernetes, use the Service DNS name and check kubectl get endpoints.

See the Docker website down checklist for container troubleshooting basics.

Step 5: remote server and firewall

For a different machine, check the network path:

nc -vz db.example.com 27017

Refused means the host is reachable but nothing listens on that address; timed out suggests a firewall or security group dropping packets (see connection refused or timed out). The Port Checker checks from the public internet, though you should keep MongoDB on a private network and allow only your application servers. For hosted clusters, add your server's IP to the provider's access list; use What Is My IP to find your current address.

Step 6: application behavior

Ensure the app does not start connecting before the database is up, and configure retries. Mongoose and the official drivers retry server selection until serverSelectionTimeoutMS (30 seconds by default), but a process that exits immediately on the first error will never recover. Log the exact URI host and port (without credentials) at startup to confirm which environment variable was used.

Verify

mongosh "mongodb://127.0.0.1:27017" connects, ss shows the listener, and your app logs a successful connection. Keep a monitor on any endpoint that depends on the database, such as /health that runs a ping, using the Uptime Monitor.

Next steps

• Read MongoDB server selection timeout.
• Compare with Node ECONNREFUSED.
• Look at Redis connection refused for the same pattern.
• Use the Website Health Check to confirm the app recovers.

FAQ

Why does ECONNREFUSED show ::1 instead of 127.0.0.1?

Your runtime resolved localhost to the IPv6 loopback address, and MongoDB is not listening there. Use 127.0.0.1 in the URI or bind MongoDB to ::1 as well.

Does the default config allow remote connections?

No. The default bind address is loopback only, so other machines are refused until you add the server's address to bindIp.

Is it safe to bind to 0.0.0.0?

Only with authentication enabled and a firewall allowing known clients. Otherwise the database is open to anyone who can reach the port.

Why does Compose work sometimes and fail on first start?

The app starts before MongoDB is ready. Add a healthcheck and make the app wait or retry.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.