Add rules to stop notifications from outside.
Note, traffic from host network (via weave expose) traffic isn't firewalled at all - stuff running outside VM/container is trusted.