listen on any host (VM-ready)