Restricting direct access to port, but allow port forwarding in Nginx
add this in your ES config to ensure it only binds to localhost
network.host: 127.0.0.1http.host: 127.0.0.1then ES is only accessible from localhost and not the world.
make sure this is really the case with the tools of your OS. e.g. on unix:
$ netstat -an | grep -i 9200tcp4 0 0 127.0.0.1.9200 *.* LISTENin any case I would lock down the machine using the OS firewall to really only allow the ports you want and not only rely on proper binding. why is this important? because ES also runs its cluster communication on another port (9300) and evil doers might just connect there.