Ok, figured it out.
The answer is detailed here: https://www.elastic.co/guide/en/elasticsearch/hadoop/master/cloud.html
Briefly, as you can see in the logs posted the client is able to connect to the cluster and get back a list of nodes. Once it has that list it tries to connect to them, but they are all inaccessible on a private network. Essentially you need to turn the ability to connect directly with the cluster nodes off, though it's noted that this can affect performance. The setting to do this is "es.nodes.wan.only": "true", though I also set "es.nodes.discovery": "false" to figure this out, so the discovery setting probably isn't necessary but I'll leave it here in case it's useful.