diff --git a/artiq/windows/default.nix b/artiq/windows/default.nix
index ff14798..36ee4c6 100644
--- a/artiq/windows/default.nix
+++ b/artiq/windows/default.nix
@@ -16,7 +16,7 @@ let
         "-m" qemuMem
         "-display" "none"
         "-bios" "${OVMF.fd}/FV/OVMF.fd"
-        "-netdev" "user,id=n1,hostfwd=tcp::2022-:22" "-device" "e1000,netdev=n1"
+        "-netdev" "user,id=n1,restrict=on,hostfwd=tcp::2022-:22" "-device" "e1000,netdev=n1"
       ];
       argStr = builtins.concatStringsSep " " (args ++ extraArgs);
     in "qemu-system-x86_64 ${argStr}";