I've been playing with the DigitalOcean setups and thought it would be nice to have the Elastic server different than the forum server. Is the tip to just connect it via IP: Port? Any tips on firewall setup for something like that?
I'd like to look into making XF more of a cluster type setup with multiple servers instead of one larger one incase it does go down one day.
CSF really depends entirely on your needs. The config file is extremely well commented. For your usage, you'll simply want to open only the single port you need for ElasticSearch and blacklist all others. You'll also want to whitelist only your main server's IP with all others blacklisted.