Silent packet drop to MongoDB Atlas cluster IPs on port 27017 (region change + restart did not help)
mathieupilonlauzon-dotcom
FREEOP

3 days ago

Summary: Our service workout-tracker (project devoted-rejoicing / production) cannot connect to our MongoDB Atlas M0 cluster. Connections silently hang for the full timeout (no SYN-ACK, no RST) on port 27017, while all other outbound traffic from the same container works normally. Failing continuously since 2026-08-01 ~21:19 UTC.

What we already ruled out:

  • Atlas IP Access List: 0.0.0.0/0 is active.
    • Cluster health: Atlas shows "ready to use" (green), replica set healthy (1 PRIMARY + 2 SECONDARY).
    • Connection string unchanged, standard mongodb+srv:// scheme.
    • Both Railway and MongoDB Atlas status pages show fully operational.
    • Restarted the deployment: no change.
    • Moved the service region from US West to US East to match the Atlas cluster's stated region and redeployed: no change, identical NetworkTimeout errors immediately after the new deployment went active.

Diagnostic run directly inside the container via the Railway web Console:

Container egress IP: 162.220.234.6

DNS resolves fine to 3 distinct hosts:

customer-apps-shard-00-00.f03lwe.mongodb.net -> 35.238.151.175

customer-apps-shard-00-01.f03lwe.mongodb.net -> 35.239.145.160

customer-apps-shard-00-02.f03lwe.mongodb.net -> 34.41.217.74

General outbound works fine:

curl -s -o /dev/null -w "%{http_code}\n" --max-time 5 https://www.google.com

-> 200

Connecting to the Atlas cluster IP on port 27017 hangs for the entire timeout, no RST, no response at all (silent drop, not "connection refused"):

time (timeout 6 bash -c 'cat < /dev/null > /dev/tcp/35.238.151.175/27017')

-> real 0m6.002s, EXIT:124 (killed by timeout, never connected)

Control test, same port 27017, different destination (portquiz.net, built to accept connections on every port) connects instantly:

time (timeout 6 bash -c 'cat < /dev/null > /dev/tcp/portquiz.net/27017')

-> real 0m0.090s, EXIT:0

This rules out a blanket port-27017 block on Railway's side in general — arbitrary destinations on port 27017 work fine. The block is specific to the 3 Atlas cluster IPs (all Google-Cloud-owned addresses, consistent with the cluster's stated US East / Virginia region).

App-level symptom for context: our Python/PyMongo backend retries 3x with socketTimeoutMS=8000 and connectTimeoutMS=8000, every attempt fails with NetworkTimeout to all 3 shard hosts, resulting in a 503 on /api/auth/register and /api/auth/login. This is currently blocking all new user registrations and logins.

Ask: could you check whether egress IP 162.220.234.6 (or the underlying NAT range for this service) is being filtered/rate-limited on the way to Google-Cloud-hosted destinations, or whether reassigning/rotating the service's egress IP would help? Happy to provide any additional deployment/project details needed. Thanks for any help.

$10 Bounty

1 Replies

Railway
BOT

3 days ago

This thread has been opened as a bounty so the community can help solve it.

Status changed to Open Railway 3 days ago


burni80
FREE

an hour ago

Railway Silent Packet Drop to MongoDB Atlas — Fixes

Hi @mathieupilonlauzon-dotcom,

You've done an excellent diagnostic job. The fact that port 27017 works fine to portquiz.net but silently drops to Google Cloud Atlas IPs points to one of two things: either Google Cloud is filtering Railway's shared egress IP range, or there's a routing issue on Railway's side for Google Cloud-owned prefixes. Either way, here are the actionable fixes ranked by effort.


1. Static Outbound IP (recommended, lowest effort)

Railway now supports dedicated static egress IPs. This gives your service a clean, single IP not shared with other tenants, which almost always bypasses reputation-based filtering.

  • Go to your service dashboard → Outbound NetworkingEnable Static IP
  • Requires at least the Hobby plan ($5/mo credit)
  • After enabling, verify the new IP with curl -s ifconfig.me from the Railway web console
  • Add the new IP to your Atlas IP Access List (or keep 0.0.0.0/0)

This is the most likely fix — a fresh dedicated IP won't be on whatever blocklist is causing the silent drop.


2. SOCKS/SSH proxy via a cheap VPS (no Railway plan change)

If upgrading the plan isn't an option, route MongoDB traffic through a lightweight proxy on any VPS:

# On a $3-5/mo VPS (Hetzner, DigitalOcean, etc.)
ssh -N -D 0.0.0.0:1080 user@your-vps-ip

Then in your Python app, use PyMongo with a SOCKS proxy:

import socks
import socket
from pymongo import MongoClient

socks.set_default_proxy(socks.SOCKS5, "your-vps-ip", 1080)
socket.socket = socks.socksocket

client = MongoClient("mongodb+srv://...")

Or simpler — set up a TCP proxy on the VPS that forwards localhost:27017 → Atlas, and point your Railway app at the proxy endpoint.


3. MongoDB Atlas Data API (driverless, no port 27017)

Atlas has a Data API that exposes collections over standard HTTPS (port 443). Since general outbound from Railway works fine (your curl google.com returns 200), this completely sidesteps the issue.

  • Enable in Atlas UI → Data ServicesData API
  • Replace PyMongo driver calls with HTTP requests via the Data API SDK
  • No port 27017 involved — everything goes over port 443

Downside: requires code changes to replace direct driver queries with REST calls.


4. Railway support escalation

Your thread already has the question-bounty tag and detailed diagnostics. If Railway engineers can rotate your service to a different egress IP or investigate their NAT routing to Google Cloud prefixes, that's the zero-effort fix. But given the 3-day silence, I'd pursue option 1 in parallel.


TL;DR

1. Static Outbound IP — 5 min · Hobby+ plan · Success: Very high

→ A fresh dedicated IP almost always escapes shared-IP reputation filtering.

2. VPS proxy — 30 min · ~$3-5/mo · Success: High

→ Route MongoDB traffic through a cheap VPS tunnel. No Railway plan change needed.

3. Atlas Data API — 1-2 hours (code changes) · Free · Success: Very high

→ Bypasses port 27017 entirely, uses standard HTTPS/443.

4. Wait for support — Unknown · Free · Success: Medium

→ Railway may rotate your egress IP or fix routing. 3 days already passed with no response.

Start with #1 (Static Outbound IP). It takes 5 minutes and costs nothing beyond the Hobby plan's $5 monthly credit.


Disclaimer: I don't work for Railway — just helping troubleshoot as a community member.


Welcome!

Sign in to your Railway account to join the conversation.

Loading...