Comment by moozeek

# 1st: accept connections from localhost

iptables -A INPUT -p tcp -s 127.0.0.1 --dport 27017 -j ACCEPT

iptables -A INPUT -p tcp -s 127.0.0.1 --dport 28017 -j ACCEPT

# 2nd: drop from all others

iptables -A INPUT -p tcp --dport 27017 -j DROP

iptables -A INPUT -p tcp --dport 28017 -j DROP