These are my flow rules which seem to work BUT the endpoints can see each other via local network. How to block network discovery???
#accept ethertype arp; # so nodes can find each other
accept ipprotocol tcp and dport 22 and dport 5900;
accept dport 22 and dport 5900;
accept; # Accept what’s left, returning SSH and VNC traffic