Only allow AXFR from internal networks