[Yandex Cloud documentation](../../../index.md) > [Yandex StoreDoc](../../index.md) > [Step-by-step guides](../index.md) > Connection > Pre-configuration

# Pre-configuring a Yandex StoreDoc cluster connection

You can connect to Yandex StoreDoc cluster hosts:

* Via the internet, if you configured public access for these hosts. You can do this when [creating the cluster](../cluster-create.md) or [updating host settings](../hosts.md#update). These hosts can only be accessed over SSL.

* From Yandex Cloud virtual machines located in the same [cloud network](../../../vpc/concepts/network.md). For hosts without public access, SSL is not required to connect to them from these virtual machines.

To connect to cluster hosts, use the following ports:

* `27018`: For a non-sharded cluster.
* `27017`: For a [sharded](../../concepts/sharding.md) cluster.

The system will automatically route write requests to the cluster’s primary replica.


{% note info %}

To enable internet connectivity to the cluster, configure public access on its primary replica.

[Automatic failover](../../concepts/replication.md) may break internet connectivity to the cluster if public access is limited to specific hosts.

{% endnote %}



## Configuring security groups {#configuring-security-groups}

To connect to a cluster, [security groups](../../../vpc/concepts/security-groups.md) must include rules allowing traffic from certain ports, IP addresses, or from other security groups.

Rule settings depend on the chosen connection method:

{% list tabs group=connection_method %}

- Over the internet {#internet}

    [Configure all cluster security groups](../../../vpc/operations/security-group-add-rule.md) to allow inbound traffic from any IP address on port `27018` for an unsharded cluster, or on port `27017` for a [sharded](../shards.md) cluster. To do this, create the following ingress rule:

    * **Port range**:
        * `27018` for a non-sharded cluster.
        * `27017` for a sharded cluster.
    * **Protocol**: `TCP`.
    * **Source**: `CIDR`.
    * **CIDR blocks**: `0.0.0.0/0`.

- From a Yandex Cloud VM {#cloud}

    1. [Configure all cluster security groups](../../../vpc/operations/security-group-add-rule.md) to allow inbound traffic from your VM’s security group on port `27018` for an unsharded cluster, or on port `27017` for a [sharded](../shards.md) cluster. To do this, create the following ingress rule in these groups:

        * **Port range**:
            * `27018` for a non-sharded cluster.
            * `27017` for a sharded cluster.
        * **Protocol**: `TCP`.
        * **Source**: `Security group`.
        * **Security group**: VM security group. If this is the same group you are currently configuring, specify `Current` (`Self`).
        
    1. [Configure the VM’s security group](../../../vpc/operations/security-group-add-rule.md) to enable connections to the VM and traffic between the VM and the cluster hosts.

        VM rule examples:

        * For inbound traffic:

            * **Port range**: `22`.
            * **Protocol**: `TCP`.
            * **Source**: `CIDR`.
            * **CIDR blocks**: `0.0.0.0/0`.

            This rule allows inbound connections to the VM over SSH.

        * For outbound traffic:

            * **Port range**: `0-65535`.
            * **Protocol**: `Any`.
            * **Source**: `CIDR`.
            * **CIDR blocks**: `0.0.0.0/0`.

            This rule permits all outbound traffic, allowing you to install any necessary certificates and tools on your VM.

{% endlist %}

{% note info %}

You can specify more granular security group rules, such as allowing traffic only in specific subnets.

Make sure to properly configure security groups for all subnets where the cluster hosts will reside. Incomplete or incorrect security group configuration can lead to a loss of access to the cluster in the event of [automatic primary replica failover](../../concepts/replication.md).

{% endnote %}

For more information, see [Security groups](../../concepts/network.md#security-groups).


## Obtaining an SSL certificate {#get-ssl-cert}

To connect to Yandex StoreDoc hosts with public access, get an SSL certificate:

{% list tabs group=operating_system %}

- Linux (Bash)/macOS (Zsh) {#linux-macos}

   ```bash
   mkdir -p ~/.mongodb && \
   wget "https://storage.yandexcloud.net/cloud-certs/CA.pem" \
        --output-document ~/.mongodb/root.crt && \
   chmod 0644 ~/.mongodb/root.crt
   ```

   The certificate will be saved to the `~/.mongodb/root.crt` file.

- Windows (PowerShell) {#windows}

   ```powershell
   mkdir $HOME\.mongodb; curl.exe -o $HOME\.mongodb\root.crt https://storage.yandexcloud.net/cloud-certs/CA.pem
   ```

   The certificate will be saved to the `$HOME\.mongodb\root.crt` file.

   Your corporate security policies and antivirus software may block the certificate download. For more information, see [FAQ](../../qa/storedoc.md#get-ssl-error).

{% endlist %}

To use graphical IDEs, [save a certificate](https://storage.yandexcloud.net/cloud-certs/RootCA.pem) to a local folder and specify the path to it in the connection settings.

## Getting FQDNs for Yandex StoreDoc hosts {#get-fqdn}

To connect to a host, you need its [FQDN](../../concepts/network.md#hostname) (fully qualified domain name). Here is an example of a Yandex StoreDoc host FQDN:

```text
rc1a-goh2a9tr********.mdb.yandexcloud.net
```

You can get the FQDN using one of the following methods:

* Check the FQDN in the management console:

    1. Navigate to the cluster page.
    1. Navigate to **Hosts**.
    1. Copy the **Host FQDN** column value.

* In the [management console](https://console.yandex.cloud), copy the cluster connection command (it contains the host’s FQDN). To get this command, navigate to the cluster page and click **Connect**.

* [Get the list of cluster hosts](../hosts.md#list-hosts) via the CLI or API.

## Limits on the number of connections {#connection-limits}

The maximum available number of simultaneous connections to a single Yandex StoreDoc cluster host depends on the amount of RAM on the host:

| Amount of RAM | Maximum number of connections |
| ------------------------:| -----------------------------------:|
| 2 GB | 2048 |
| 4 GB | 4096 |
| 8 GB | 8192 |
| 16 GB or higher | 16 384 |

A host's RAM size depends on its class. All available options are listed under [Host classes](../../concepts/instance-types.md).

## Installing MongoDB Shell {#mongosh-install}

To connect to a Yandex StoreDoc cluster from either Linux (using Bash) or Windows (using PowerShell), install MongoDB Shell:

{% list tabs group=connection %}

- Linux {#linux}

  1. If you do not have Homebrew yet, install it:

      ```bash
      /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
      ```

  1. Add `brew` to `PATH`:

      ```bash
      echo >> /home/<username>/.bashrc && \
      echo 'eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"' >> /home/<username>/.bashrc && \
      eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
      ```

  1. Install the dependencies:

      ```bash
      sudo apt-get install build-essential
      ```

  1. Install the `mongodb-atlas-cli` package:

      ```bash
      brew install mongodb-atlas-cli
      ```

- Windows 10/11 {#windows}

  You can use one of the following methods:

  * Download and install the MongoDB Shell `*.msi` package from the [official GitHub repository](https://github.com/mongodb-js/mongosh/releases).
  * Install MongoDB Shell via [Chocolatey](https://chocolatey.org/install) by running this command:

    ```bash
    choco install mongodb-shell
    ```

{% endlist %}

## What's next {#whats-next}

* [Connect](clients.md) to the cluster using either command-line tools, a graphical IDE, or a Docker container.
* [Integrate](code-examples.md) the cluster connection into your application code.