Security Overview
You can implement both network and application security. For most deployments, network security with public access to read-only APIs provided by application servers (API nodes) should be enough.
Network Security
- All public traffic is routed through a load balancer / proxy server.
- Only HTTPS protocol is available on public LAN.
- Admin APIs are only available on private LAN.
- It is not recommended to expose any Elasticsearch APIs to the public.
- All public read-only APIs are provided by application servers (API nodes).

Ports
If you run a firewall, the following ports have to be open on private LAN:
Elasticsearch nodes:
- 9200 - Elasticsearch clients connect to this port
- 9300 - Elasticsearch nodes communicate over this port
API nodes:
- 8000 - API clients connect to this port
Elasticsearch
Authentication
Elasticsearch supports multiple authentication schemes, such as
- Basic
- Mutual TLS
- OpenID Connect
- LDAP / Active Directory
- Custom
Authorization
- Role Based