Limits of Neo4j Bolt Connector advertised_address on preventing accidental public exposure

The Short Answer

No, setting dbms.connector.bolt.advertised_address to a specific IP address does not restrict network exposure when dbms.connector.bolt.listen_address is set to 0.0.0.0. If the listener is bound to all interfaces, the database remains reachable on all of them, regardless of what address is advertised to clients.

How Advertised Address Works

In Neo4j, there is a critical distinction between the bind address (where the server listens for traffic) and the advertised address (what the server tells clients to use for future connections). This is primarily used for routing in clustered environments or when the database is behind a NAT/Load Balancer.

The Exposure Gap

• Listen Address (0.0.0.0): This tells the operating system to open the Bolt port on every available network interface (Ethernet, Wi-Fi, Loopback, etc.). Any device that can route to those IPs can attempt a connection.
• Advertised Address: This is metadata sent back to the driver during the initial handshake. It tells the driver, "If you need to reconnect or route a request, use this IP." It does not act as a firewall or a filter for incoming packets.

Impact of Disabled Authentication

If authentication is disabled, the advertised_address provides zero protection. Since the socket is open on 0.0.0.0, any client that can reach the server's IP can establish a Bolt session and execute queries without credentials. The advertised address only changes the routing instructions given to the client; it does not validate the identity or origin of the client.

Required Security Controls

To prevent accidental public exposure, administrators must implement actual access controls rather than relying on routing metadata:

1. Restrict Bind Address: Change dbms.connector.bolt.listen_address from 0.0.0.0 to a specific internal IP (e.g., 10.0.0.5) or 127.0.0.1 for local-only access.
2. Enable Authentication: Ensure dbms.security.auth_enabled=true is set to prevent unauthenticated access.
3. Network Layer Security: Use OS-level firewalls (iptables, ufw) or Cloud Security Groups to restrict traffic to the Bolt port (default 7687) to trusted CIDR blocks.

Verification Command

To verify which interface Neo4j is actually listening on, use the following command on the host machine (Linux):

ss -tlnp | grep 7687

If the output shows *:7687 or 0.0.0.0:7687, the server is exposed on all interfaces, regardless of the advertised_address setting.