allow internal hosts to connect