Restrict VM traffic to host