MongoDB binaries should bind to localhost by default. This will allow small deployments and testing environments to be used from localhost, while not being accessible from the internet.
The following changes shall be made:
1) All mongod and mongos 3.6 binaries shall bind to 127.0.0.1 by default. When the --ipv6 argument is provided, then the server should additionally bind to the IPv6 address ::1. The server may be instructed to listen to internet traffic by starting it with arguments to --bind_ip that select a routable IP or IPv6 address.
2) If no explicit bind_ip has been provided, print a startup warning indicating that the server is not responding to external connections, which describes how to fix the problem.
3) A flag --bind_ip_all will be added to the server. When set, it shall cause the server to bind to all addresses.