I've been wondering about this.
Assume a host with a strong firewall setup (for example only allowing port 80). That host has some virtual machines without firewall.
Why the connections made on these virtual machines aren't rejected by the firewall in the host? At the end, the VM it's only a program running in the host like any other program.