Allow address as well as IP for metadata.
Ban traffic to the loopback address from VMs
(unless for metadata)