I run ElasticSearch on the same box as my Apache webserver (one single VPS). I authenticate every request to ElasticSearch.

gistfile1.txt

1. Drop all incoming connections to ElasticSearch on port 9200:

  iptables -A INPUT -j DROP -p tcp --destination-port 9200 -i eth0

2. Persist this change on reboot:
  
  iptables-save > /root/my_iptables_config
  /sbin/iptables-restore < /root/my_iptables_config

3. Create a directory in your web application, I usually name mine /_es and add an .htaccess file.
   This will pass authenticated requests to ElasticSearch as usual e.g. http://mydomain.com/_es/{path}

  Order deny, allow
  Deny from all

  # first check user/pass
  AuthUserFile /var/www/mydomain.com/www/_es/.htpasswd
  AuthType Basic
  AuthName "Log In"
  Require valid-user

  # if not, check my own IP
  # useful for development to bypass authentication. Remove in production.
  Allow from 82.1.152.153

  Satisfy Any

  <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(.+) http://127.0.0.1:9200/$1 [P]
  </IfModule>