firewall rule for internal elasticsearch