Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesTo connect an application to MongoDB Atlas without sending database traffic over the public internet, configure private connectivity in the cloud network first, then use the connection string that Atlas provides for that path. The two supported designs are VPC/VNet peering, which adds routed connectivity between your network and Atlas, and a cloud private endpoint, which creates a one-way interface connection from your network to Atlas.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Your application still needs normal MongoDB authentication, TLS, route and firewall rules, and an Atlas network-access rule. A hostname resolving to a public address, or a client outside the configured VPC or VNet, means the private path is not being used.
As an Amazon Associate I earn from qualifying purchases.
What a private Atlas connection changes
A normal internet connection reaches Atlas through publicly reachable addresses. A private connection keeps the network path on internal cloud addresses controlled by your cloud account and Atlas. Private connectivity does not replace database authentication or encryption; it changes how packets reach the cluster and which network boundaries can carry them.
Atlas documents two patterns. Peering joins the routing domains of your application network and the Atlas network, so traffic can travel between them using private addresses. A private endpoint exposes an interface endpoint in your VPC or VNet and accepts connections from that interface; Atlas cannot initiate a reciprocal connection into your network. That one-way model is useful when your security policy allows outbound access to a managed service but does not allow the service to route back into application subnets.
#1 Best Overall
Choose the design that fits your network
| Decision point | VPC/VNet peering | Private endpoint |
|---|---|---|
| Network model | Routed connectivity between your network and the Atlas network. | One-way interface connection from your VPC or VNet to Atlas. |
| Cluster eligibility | Not available for free M0 or Flex clusters. | Requires an M10 or larger cluster. |
| Main setup work | Non-overlapping CIDRs, cloud DNS settings, route-table entries, and Atlas network access. | Provider interface endpoint, Atlas endpoint approval or completion, private DNS, and endpoint security rules. |
| Connection string | The standard Atlas connection string in supported peered-network conditions. | The private-endpoint-aware string generated by Atlas; the DNS seedlist form is preferred. |
| Best fit | You control both networks and need direct private routing between them. | You want interface-endpoint controls and no reciprocal Atlas-to-VPC or Atlas-to-VNet route. |
| Regional planning | Plan peering for every Atlas region whose nodes your clients must reach. | Provision private connectivity in every region containing nodes that clients may use. |
Peering is often simpler when your organization already manages shared cloud routing and accepts a reciprocal network relationship. A private endpoint is usually the cleaner boundary when the application should consume Atlas as a service through an interface rather than join two routed networks. The choice does not remove the need for DNS, firewall, and Atlas access-list configuration.
Confirm prerequisites before changing anything
Verify tier and regional support
- Free M0 and Flex clusters cannot use VPC or VNet peering.
- Private endpoints require M10 or higher.
- For a multi-region deployment, identify every region that contains Atlas nodes used by your clients. Private connectivity must be configured for each relevant region, not only the region where the application was first deployed.
Map the network ranges
Record the CIDR of each application VPC or VNet, the CIDR Atlas will use for peering where applicable, and the ranges used by other peering connections. Peering cannot be created with overlapping ranges. Overlap can exist indirectly through a transit network or another connected environment, so check the complete route design rather than comparing only the two primary networks.
Prepare DNS and security ownership
- Enable cloud DNS hostnames and DNS resolution where your provider requires those settings for private service discovery.
- Decide which team owns cloud route tables, security groups or network security groups, private DNS zones, and Atlas network access.
- Keep the application’s database credentials and TLS settings unchanged unless your Atlas deployment has a separate authentication requirement. Private networking is not an authorization mechanism.
How to configure VPC or VNet peering
Peering works by making the Atlas CIDR reachable through a peering target in your application network. Complete the cloud and Atlas portions in the order below so a route does not point at an unfinished connection.
- Confirm eligibility and region. Check that the cluster is not M0 or Flex, that the cloud provider and region support peering, and that you have permissions in both Atlas and the cloud account.
- Enable private DNS prerequisites. In the application VPC or VNet, turn on DNS hostnames and DNS resolution if they are disabled. These settings allow Atlas hostnames to resolve to the addresses expected over the private path.
- Create the peering request. In Atlas, start a peering connection for the selected cloud provider and region. Supply a private Atlas CIDR that does not overlap the application network or any other connected network. Keep a record of the Atlas CIDR; it is the destination used in the application route table.
- Accept or complete the cloud-side connection. Finish the provider’s peering workflow, including account, project, subscription, or tenant details requested by the cloud console. The connection is not usable merely because a request appears in Atlas; it must reach an active or accepted state on both sides.
- Add the route. In every application subnet route table that needs database access, add the Atlas CIDR as the destination and the peering connection as the target. If clients run in more than one VPC, VNet, or shared-services subnet, repeat the route design for each path rather than assuming one table covers all workloads.
- Allow the clients in Atlas. Add the application CIDR or the permitted security-group-based source to Atlas network access. A successful cloud route with no Atlas access rule still produces a refused connection.
- Deploy the standard string. Copy the standard connection string from Atlas after peering is active and place it in the application’s secret store. Atlas states that, after the network is configured, the application automatically uses the peered VPC network when it connects through that string.
Peering in a multi-region deployment
A cluster with nodes in several regions can require private connectivity to each region that serves client traffic. Build the regional peering and route entries deliberately, then verify DNS and reachability from a workload in each region. Do not assume that a peering connection in the application’s home region automatically creates a private path to every Atlas region.
How to configure a private endpoint
A private endpoint uses an interface endpoint supplied by the cloud provider. The interface receives private addresses in your VPC or VNet; Atlas then associates the endpoint with the requested cluster or project.
- Verify the cluster tier. The private-endpoint option requires M10 or higher. Confirm the endpoint feature is available in the Atlas region and that the endpoint will be created in the same region as the Atlas cluster connection you are configuring.
- Create the provider interface endpoint. In the cloud console, create an interface endpoint for the Atlas service in the appropriate VPC or VNet and subnets. Attach the security group or network security group that permits the application’s database traffic to the endpoint. Record the endpoint identifier and the private addresses assigned by the provider.
- Complete the Atlas side. In Atlas, add or complete the private endpoint using the provider endpoint details. Wait for Atlas and the cloud provider to show the endpoint as available before changing production secrets.
- Configure private DNS. Ensure that clients in the application subnets resolve the private-endpoint-aware Atlas hostname to the interface endpoint addresses. A private DNS zone, forwarding rule, or provider-managed private DNS association may be required by your cloud design. Clients outside the associated network will not automatically receive the private answer.
- Use the generated endpoint-aware string. Copy the private-endpoint connection string from Atlas. Prefer the DNS seedlist form rather than hard-coding a single port. MongoDB notes that ports used by AWS PrivateLink can change, so a string that assumes one fixed port can become invalid.
- Repeat for every required region. If clients can connect to nodes in multiple Atlas regions, provision private connectivity for each region containing those nodes and make the corresponding private DNS names available to the clients.
Connection strings, DNS, and port behavior
Use the string that matches the network path
For peering, use the standard Atlas connection string after the peering connection, routes, DNS, and Atlas access rule are active. For a private endpoint, use the endpoint-aware string shown by Atlas; a public string copied from a different connection option is not a substitute.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
Why the DNS seedlist form is preferred for endpoints
A DNS seedlist connection string lets the driver discover the members and ports that Atlas advertises for the private endpoint. MongoDB strongly recommends this form for PrivateLink because endpoint ports can change. Do not replace the generated hostnames with a manually maintained list of IP addresses unless your driver and Atlas documentation explicitly require that design.
What a public DNS answer means
If an Atlas hostname resolves to a public IP while the client is expected to use private networking, investigate the network context before changing application code. Common causes are disabled VPC DNS hostnames, disabled DNS resolution, missing private DNS association, or a client running outside the peered VPC or VNet. DNS answers are determined by where the lookup originates; a laptop on the internet will not necessarily receive the same answer as a workload inside the configured cloud network.
Allow the endpoint’s port range
With PrivateLink, permit the port range required by the endpoint rather than assuming a single permanent database port. MongoDB documents AWS PrivateLink ports beginning at 1024 and potentially extending through 65535. Apply the narrowest range that Atlas and your provider currently require, and revisit the rule if Atlas changes the endpoint allocation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security controls that must line up
Private addressing does not make a cluster reachable by every workload in the network. Treat each layer as an independent gate:
- Atlas network access: allow only the application CIDR or approved security-group source. Avoid adding a broad corporate or cloud CIDR when a workload-specific range is available.
- Cloud security rules: permit outbound traffic from the application security group to the peering target or interface endpoint, and permit the return traffic required by the provider’s stateful firewall model.
- Route tables: associate the Atlas destination with the correct peering target, or ensure the interface endpoint is reachable from every client subnet.
- DNS scope: associate private zones or endpoint DNS names only with networks that should resolve them. Keep public and private records from being mixed accidentally.
- Database identity: continue using least-privilege MongoDB users, TLS validation, secret rotation, and driver versions supported by your application.
Troubleshoot the most common failures
| Symptom | Likely cause | What to check or change |
|---|---|---|
| Atlas hostname returns a public IP | Cloud DNS hostnames or DNS resolution is disabled; private DNS is not associated; or the client is outside the configured VPC or VNet. | Run the lookup from the actual application subnet, verify both cloud DNS settings, and confirm the endpoint or peering DNS configuration is visible to that subnet. |
| Peering request cannot be created | The Atlas and application CIDRs overlap, possibly through another connected network. | Compare all routed CIDRs, choose a non-overlapping Atlas range, and redesign dependent routes before retrying. |
| DNS resolves privately but the TCP connection times out | The route is absent, the interface endpoint is in an unreachable subnet, or a cloud firewall blocks the required traffic. | Check the destination route in every client subnet, endpoint subnet associations, security groups or network security groups, and the endpoint port range. |
| TCP connects but Atlas rejects the client | Atlas network access does not include the application source CIDR or approved security group. | Add the actual source recognized by Atlas, then wait for the rule to apply and retry with the same credentials. |
| Only one region works | Private connectivity or private DNS was configured for one Atlas region but not the others. | List the regions containing reachable nodes and provision the missing regional peering or endpoint paths. |
| Private endpoint string stops working after a change | The application hard-coded a port or used a non-endpoint connection string. | Replace it with the current DNS seedlist private-endpoint string generated by Atlas and allow the provider’s required port range. |
| Connections work from a server but not from a developer workstation | The workstation is not inside the peered network or does not use the private DNS resolver. | Test from a workload that is actually attached to the VPC or VNet, or provide an approved private access path instead of exposing Atlas publicly. |
| Endpoint appears created but Atlas has no usable connection | The provider endpoint and Atlas endpoint records are not both in an available or completed state. | Match the provider endpoint identifier to the Atlas entry, finish any pending approval, and only then distribute the endpoint-aware string. |
Operational limits and regional planning
| Limit or rule | Practical meaning |
|---|---|
| M0 and Flex do not support VPC or VNet peering | Use an eligible cluster tier before planning a peering architecture. |
| Private endpoints require M10 or higher | An endpoint design cannot be applied to a free or Flex cluster. |
| AWS PrivateLink port allocation can vary | Use the Atlas DNS seedlist string and permit the required endpoint range instead of assuming one fixed port. |
| Up to 50 addressable targets per AWS PrivateLink region | Count the Atlas targets your design must expose in each region when planning endpoint capacity. |
| Up to 50 peering connections per project | Track project-wide peering consumption when multiple application networks or accounts need access. |
These are documented configuration limits, not performance guarantees. Availability, supported regions, endpoint behavior, and tier eligibility can change, so confirm the current Atlas and cloud-provider documentation when expanding the design.
Validate the private path before production traffic
- Run a DNS lookup from a workload in each intended client subnet and verify that the returned addresses match the private endpoint or peered-network design, not public addresses.
- Confirm the route table used by that workload contains the Atlas destination or a reachable interface endpoint.
- Check the cloud firewall rule for the exact source security group or subnet and the endpoint’s required port range.
- Check Atlas network access for the source that Atlas actually sees.
- Connect with the current Atlas-generated string and verify TLS certificate validation and database authentication.
- Repeat the test in every relevant Atlas region and from each application network that will carry production traffic.
- Store the connection string in a managed secret, document the owning team for DNS and routes, and monitor endpoint, peering, and certificate changes as part of normal network operations.
When these checks pass, the private design is complete: the application resolves Atlas through the intended private DNS path, routes traffic through peering or an interface endpoint, and remains restricted by both cloud controls and Atlas network access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
