restrict pipe to localhost