Setting bind and publish IPs

Hi There.. I know this is covered elsewhere... but I still seem to be having issues.
Elasticsearch version 7.9.2
I have a cluster.. with 2 ,masters (I know.. its development), and 2 data nodes. All good. Set up to use the local vpc Ips 10.0.1.0/24 .

I now need to add 1 coordinatoing node and one ingest node. Both need to be public facing, but on the same internal network as teh rest of teh cluster, but they also have Public Ips.

My concept, which I thought woul,d be easy.. is:

web client ---> |ingest node publicIP:9200 |  ---> |cluster 10.0.1.0/24:9200|

I also, now, understnad that the:
network.bind_host -> array of ports to bind to on 9200
network.publish_host -> port 9300 to say to cluster 'Hi .. I am here'

I am getting all teh errors under the sun, except when I use 0.0.0.0, in which case my web client cant communicate. have had a couple of times with a PublicIP:9300 cant communicate/connect, type error.

Should I be using:

  1. http.bind_host: PublicIP (on port 9200) -> Web Client to connect to
  2. http.publish_host: PublicIP (on port 9200) -> This node to say 'Hi'

3., transport.bind_host: Internal IP (on port 9300) -> This host to talk with cluster
4. transport.publish_host: Internal IP (on port 9300) -> This host to say 'Hi' to the cluster

Using just:
network.host failed.
network.bind_host / publish_host failed

Any help in sorting my head out greatly appreciated

------ Example -----

  • elasticsearch.yml
...
# network.host: 10.0.1.10, publicIP 
# network.bind_host: PublicIP:9200
# network.bind_host: ["10.0.1.10","0.0.0.0"]
network.bind_host: ["0.0.0.0"]
network.publish_host: 10.0.1.10
...

Started....
_cat/nodes output

10.0.1.10  4 61 3 0.14 0.24 0.17 - - ES-Query-1          <-- This is the one
10.0.1.8  26 82 0 0.02 0.05 0.07 m * ES-Master-2
10.0.1.4  23 69 0 0.00 0.02 0.02 d - ESData-1
10.0.1.5  35 69 0 0.06 0.04 0.02 d - ESData-2
10.0.1.6  44 81 0 0.00 0.03 0.04 m - ES-Master-1

Log Output

[2020-10-17T23:14:46,406][INFO ][o.e.n.Node               ] [ES-Query-1] initialized
[2020-10-17T23:14:46,407][INFO ][o.e.n.Node               ] [ES-Query-1] starting ...
[2020-10-17T23:14:46,527][INFO ][o.e.t.TransportService   ] [ES-Query-1] publish_address {10.0.1.10:9300}, bound_addresses {[::]:9300}
[2020-10-17T23:14:46,704][INFO ][o.e.b.BootstrapChecks    ] [ES-Query-1] bound or publishing to a non-loopback address, enforcing bootstrap checks
[2020-10-17T23:14:46,922][INFO ][o.e.c.s.ClusterApplierService] [ES-Query-1] master node changed {previous [], current [{ES-Master-2}{p_-HGOuoSxWk39C7dkTpKA}{brnqGDA3Rzm7cbVw-x-9Fg}{10.0.1.8}{10.0.1.8:9300}{m}{xpack.installed=true, transform.node=false}]}, added {{ES-Master-2}{p_-HGOuoSxWk39C7dkTpKA}{brnqGDA3Rzm7cbVw-x-9Fg}{10.0.1.8}{10.0.1.8:9300}{m}{xpack.installed=true, transform.node=false},{ESData-2}{vJ3TTJcrRwmhwv7S0d_qzw}{xfgBVP7cQ6OufEgRcJC9vg}{10.0.1.5}{10.0.1.5:9300}{d}{xpack.installed=true, transform.node=false},{ES-Master-1}{DSt6X45uRMSj5kI5Zl3Clg}{s0c8MMD-RLmqj-4vCFz_vA}{10.0.1.6}{10.0.1.6:9300}{m}{xpack.installed=true, transform.node=false},{ESData-1}{1FPzmwf3Qo-vWAJC1uvZkg}{oVclU8EXQ2eJsylcqief5A}{10.0.1.4}{10.0.1.4:9300}{d}{xpack.installed=true, transform.node=false}}, term: 9, version: 57, reason: ApplyCommitRequest{term=9, version=57, sourceNode={ES-Master-2}{p_-HGOuoSxWk39C7dkTpKA}{brnqGDA3Rzm7cbVw-x-9Fg}{10.0.1.8}{10.0.1.8:9300}{m}{xpack.installed=true, transform.node=false}}
[2020-10-17T23:14:47,074][INFO ][o.e.x.s.a.TokenService   ] [ES-Query-1] refresh keys
[2020-10-17T23:14:47,252][INFO ][o.e.x.s.a.TokenService   ] [ES-Query-1] refreshed keys
[2020-10-17T23:14:47,279][INFO ][o.e.l.LicenseService     ] [ES-Query-1] license [bd72d578-2d98-4cdb-99e3-938096e3fc14] mode [basic] - valid
[2020-10-17T23:14:47,281][INFO ][o.e.x.s.s.SecurityStatusChangeListener] [ES-Query-1] Active license is now [BASIC]; Security is disabled
[2020-10-17T23:14:47,303][INFO ][o.e.h.AbstractHttpServerTransport] [ES-Query-1] publish_address {10.0.1.10:9200}, bound_addresses {[::]:9200}
[2020-10-17T23:14:47,303][INFO ][o.e.n.Node               ] [ES-Query-1] started

As you can see the only bound addresses are the local loopback or internal IPs... not the Public IP.