3 days ago
Summary: Our service workout-tracker (project devoted-rejoicing / production) cannot connect to our MongoDB Atlas M0 cluster. Connections silently hang for the full timeout (no SYN-ACK, no RST) on port 27017, while all other outbound traffic from the same container works normally. Failing continuously since 2026-08-01 ~21:19 UTC.
What we already ruled out:
- Atlas IP Access List: 0.0.0.0/0 is active.
-
- Cluster health: Atlas shows "ready to use" (green), replica set healthy (1 PRIMARY + 2 SECONDARY).
-
- Connection string unchanged, standard mongodb+srv:// scheme.
-
- Both Railway and MongoDB Atlas status pages show fully operational.
-
- Restarted the deployment: no change.
-
- Moved the service region from US West to US East to match the Atlas cluster's stated region and redeployed: no change, identical NetworkTimeout errors immediately after the new deployment went active.
Diagnostic run directly inside the container via the Railway web Console:
Container egress IP: 162.220.234.6
DNS resolves fine to 3 distinct hosts:
customer-apps-shard-00-00.f03lwe.mongodb.net -> 35.238.151.175
customer-apps-shard-00-01.f03lwe.mongodb.net -> 35.239.145.160
customer-apps-shard-00-02.f03lwe.mongodb.net -> 34.41.217.74
General outbound works fine:
curl -s -o /dev/null -w "%{http_code}\n" --max-time 5 https://www.google.com
-> 200
Connecting to the Atlas cluster IP on port 27017 hangs for the entire timeout, no RST, no response at all (silent drop, not "connection refused"):
time (timeout 6 bash -c 'cat < /dev/null > /dev/tcp/35.238.151.175/27017')
-> real 0m6.002s, EXIT:124 (killed by timeout, never connected)
Control test, same port 27017, different destination (portquiz.net, built to accept connections on every port) connects instantly:
time (timeout 6 bash -c 'cat < /dev/null > /dev/tcp/portquiz.net/27017')
-> real 0m0.090s, EXIT:0
This rules out a blanket port-27017 block on Railway's side in general — arbitrary destinations on port 27017 work fine. The block is specific to the 3 Atlas cluster IPs (all Google-Cloud-owned addresses, consistent with the cluster's stated US East / Virginia region).
App-level symptom for context: our Python/PyMongo backend retries 3x with socketTimeoutMS=8000 and connectTimeoutMS=8000, every attempt fails with NetworkTimeout to all 3 shard hosts, resulting in a 503 on /api/auth/register and /api/auth/login. This is currently blocking all new user registrations and logins.
Ask: could you check whether egress IP 162.220.234.6 (or the underlying NAT range for this service) is being filtered/rate-limited on the way to Google-Cloud-hosted destinations, or whether reassigning/rotating the service's egress IP would help? Happy to provide any additional deployment/project details needed. Thanks for any help.
1 Replies
3 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 3 days ago
an hour ago
Railway Silent Packet Drop to MongoDB Atlas — Fixes
Hi @mathieupilonlauzon-dotcom,
You've done an excellent diagnostic job. The fact that port 27017 works fine to portquiz.net but silently drops to Google Cloud Atlas IPs points to one of two things: either Google Cloud is filtering Railway's shared egress IP range, or there's a routing issue on Railway's side for Google Cloud-owned prefixes. Either way, here are the actionable fixes ranked by effort.
1. Static Outbound IP (recommended, lowest effort)
Railway now supports dedicated static egress IPs. This gives your service a clean, single IP not shared with other tenants, which almost always bypasses reputation-based filtering.
- Go to your service dashboard → Outbound Networking → Enable Static IP
- Requires at least the Hobby plan ($5/mo credit)
- After enabling, verify the new IP with
curl -s ifconfig.mefrom the Railway web console - Add the new IP to your Atlas IP Access List (or keep
0.0.0.0/0)
This is the most likely fix — a fresh dedicated IP won't be on whatever blocklist is causing the silent drop.
2. SOCKS/SSH proxy via a cheap VPS (no Railway plan change)
If upgrading the plan isn't an option, route MongoDB traffic through a lightweight proxy on any VPS:
# On a $3-5/mo VPS (Hetzner, DigitalOcean, etc.)
ssh -N -D 0.0.0.0:1080 user@your-vps-ipThen in your Python app, use PyMongo with a SOCKS proxy:
import socks
import socket
from pymongo import MongoClient
socks.set_default_proxy(socks.SOCKS5, "your-vps-ip", 1080)
socket.socket = socks.socksocket
client = MongoClient("mongodb+srv://...")Or simpler — set up a TCP proxy on the VPS that forwards localhost:27017 → Atlas, and point your Railway app at the proxy endpoint.
3. MongoDB Atlas Data API (driverless, no port 27017)
Atlas has a Data API that exposes collections over standard HTTPS (port 443). Since general outbound from Railway works fine (your curl google.com returns 200), this completely sidesteps the issue.
- Enable in Atlas UI → Data Services → Data API
- Replace PyMongo driver calls with HTTP requests via the Data API SDK
- No port 27017 involved — everything goes over port 443
Downside: requires code changes to replace direct driver queries with REST calls.
4. Railway support escalation
Your thread already has the question-bounty tag and detailed diagnostics. If Railway engineers can rotate your service to a different egress IP or investigate their NAT routing to Google Cloud prefixes, that's the zero-effort fix. But given the 3-day silence, I'd pursue option 1 in parallel.
TL;DR
1. Static Outbound IP — 5 min · Hobby+ plan · Success: Very high
→ A fresh dedicated IP almost always escapes shared-IP reputation filtering.
2. VPS proxy — 30 min · ~$3-5/mo · Success: High
→ Route MongoDB traffic through a cheap VPS tunnel. No Railway plan change needed.
3. Atlas Data API — 1-2 hours (code changes) · Free · Success: Very high
→ Bypasses port 27017 entirely, uses standard HTTPS/443.
4. Wait for support — Unknown · Free · Success: Medium
→ Railway may rotate your egress IP or fix routing. 3 days already passed with no response.
Start with #1 (Static Outbound IP). It takes 5 minutes and costs nothing beyond the Hobby plan's $5 monthly credit.
Disclaimer: I don't work for Railway — just helping troubleshoot as a community member.