You should run your Elasticsearch nodes in a VPC (Virtual Private Cloud). More recently, AWS creates all nodes in a VPC. The nodes that do not need to interface with the clients accept the queries from clients over HTTP. This can be done by setting http.host in elasticsearch.yml. You can find out more about the HTTP host/port bindings in the reference documentation at https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-http.html.