make ES only accessible from lo