The public rustdesk.seahaven.com name resolves to the EIP, which the
security group blocks on the admin port (21114). Add an internal-only
rustdesk-admin.int.seahaven.com record pointed at the instance private IP
so the console is reachable over the VPN without using the raw IP.