Your firewall configuration is outside the scope of what we can help with, but you can set MultiChain to allow incoming JSON-RPC connections from a wide range of IP addresses using the rpcallowip parameter in the runtime parameters for your chain.
You can have as many rpcallowip lines as you want, using one of these standard forms (fixed IP, mask, CIDR notation).
rpcallowip=10.1.1.34
rpcallowip=192.168.1.0/255.255.255.0
rpcallowip=172.16.0.0/24
I found some information about the AWS IP addresses used here:
https://aws.amazon.com/blogs/aws/aws-ip-ranges-json/
Of course, this will not be particularly secure, because loads of people use AWS, and your MultiChain instance will only be protected by the password. But maybe that's OK for your use case.