Forbid mongodb not authenticated connect
A new connection to MongoDB has two key aspects:


establishing a connection
authenticating the connection


As at MongoDB 3.4, the source IPs that are able to establish a connection are determined by  your firewall settings. There is also a bindIp setting for MongoDB which determines which network interface(s) mongod listens to.

Once a connection is established, access control and authentication is managed by your MongoDB configuration.

In your example, you are able to connect via the mongo shell because the source IP is not blocked by firewall configuration. Assuming access control is enabled and authentication has been properly configured, establishing a connection to MongoDB does not provide any access to data.

For more information on best practices, see the MongoDB Security Checklist.