Workload VMs connect to the Internet by default. NAT rules and distributed firewall rules give you fine-grained control over these connections.