expose ports only to local interface