Virtualised environments are focused on isolating the guest OS. Using the VirtualBox model, the guest might be behind a virtual NAT and/or talk only with other VMs via internal networks, and only with the host via host-only networks.
All these methods are meant to make the host invisible and unreachable from the outside internet, while allowing inbound connections from other VMs and host.
What if one runs server services on the host for the guests?
Is it possible to shield the host from the outside world, while allowing inbound traffic from the guest machines?
A simple method would be restricting the listening ports on the host to the virtual machine/network IPs. But another box sitting in the same network of the host might spoof the IP and pretend to be a VM. Outside the host the gateway device might check for the actual IP of the spoofer matches its packet sources But we don't know who is and how wary is the admin. So how can we manage security inside the host? For example have the host listening only to inbound traffic from VMs.
