document how to restrict a firewall to a specific host