Skip to main content

Connect to database with Floating IP

Connecting to a MongoDB cluster takes two things: network access and credentials. You open access with a Security Group, and add a Floating IP if the client sits outside the VPC.

If your application already runs inside the same VPC, you can skip the Floating IP section entirely — that is the recommended shape for production.

Prerequisites​

  • A cluster in Running status. See Create your first database.
  • Permission to manage Security Groups and Floating IPs in the VPC.
  • A MongoDB client, mongosh, or a driver for your language.

How connections reach the cluster​

Each cluster is provisioned with a standard MongoDB connection endpoint, expressed as a MongoDB URI. Connecting through the endpoint rather than a node address means your application:

  • Stays decoupled from the cluster's internal topology
  • Is minimally affected by failover or topology changes
  • Has one connection string to manage rather than several

Private and public access​

ModelWhat it allowsUse it for
Private AccessConnections only from internal networks such as the VPCProduction and anything with strict security requirements
Public AccessA public endpoint reachable from the internet, with additional controlsExternal integrations, temporary administrative access, development and testing
warning

Before enabling public access, weigh the security, performance, and architectural consequences. A public endpoint widens the attack surface permanently, not just while you are using it.

Create a Security Group​

A Security Group is a set of stateful firewall rules controlling inbound and outbound traffic to database instances, matched on IP address or CIDR range, port, and protocol.

Security Groups are how you enforce least privilege — allowing only trusted sources such as applications in the same VPC, bastion hosts, and authorized management systems.

  1. Log in to FPT Cloud Portal.

  2. From the main menu, select Network → Security Groups.

  3. Click Create security group.

    Create New Security Group form with name, instances, tags, and rules

  4. Fill in the fields:

    • Name — up to 50 characters of letters, numbers, and hyphens.
    • Applied Instances (optional) — the database instance the group applies to.
    • Add tag (optional) — key-value tags for classification and auditing.
    • Configure security rule (optional) — inbound rules take allowed sources in Source; outbound rules take destinations in Destination. Internal-only communication usually needs no outbound rule.

  5. Click Create security group.

Changes to a Security Group take effect immediately and do not require a cluster restart.

warning

Deleting a Security Group removes all its rules at once, which can cut connectivity for any cluster still using it. Confirm nothing depends on it first.

Assign a Floating IP​

A Floating IP is a public address you attach to a node for internet access. It does nothing on its own — traffic still has to pass the Security Group rules.

Typical reasons to use one:

  • Access from on-premises or external systems
  • Temporary administrative or operational access
  • Testing and integration work

  1. From the main menu, select Network → Floating IPs.

  2. Click Allocate IP address.

    Allocate IP address dialog with address, resource, and port fields

  3. Fill in the fields:

    • IP address — Allocate new from pool, or Existing IP to reuse one.
    • Resources — set type to Instance, then select the target node.
    • IP Port / Instance port (optional) — for port forwarding or custom NAT. Leave blank for defaults.
    • Add tag (optional).

  4. Click Allocate floating IP.

Release an address you no longer need with Release IP.

tip

Pair every Floating IP with Security Group rules that restrict source IP ranges and open only the MongoDB port. A Floating IP with permissive rules exposes the cluster to the whole internet.

Connect with a client​

Find the connection details​

Open the cluster detail page and read them from the Overview tab.

Database Overview tab showing endpoint, port, and credentials

You need the endpoint (domain or IP), port, database name, username, and password.

Establish the connection​

Connect in whichever way suits your workflow:

  • A management tool such as MongoDB Compass — supply the endpoint, port, credentials, and database name.
  • The command line, using mongosh with the connection URI.
  • An application, using the official MongoDB driver for your language.

Once connected, you can browse collections and run queries.

note

If the connection times out, the cause is almost always network policy rather than credentials. Check the Security Group inbound rules first — a missing rule for the MongoDB port is the usual omission.

Security best practices​

  • Enable Floating IP only when you actually need it.
  • Prefer Private Access for production workloads.
  • Write Security Group rules for minimum exposure.
  • Review and update access rules regularly, rather than only at provisioning.

Next steps​