firewall on vm: will pass through imap, etc. / serve ntp, dns, etc. / serve http(s) proxy / act like vpn server from outside the network. Clients will still able to connect between each other ...