My guest VMs have internal NAT addresses of 172.16.108.x and I'm able to ping and access the tcp services host via my gateway address of 172.16.108.2, I have the equivalent access via the host's external Airport IP of 192.168.1.106.

Is there a preference as to which address is recommended to access the host? I've always thought it's anomaly to be able to access the host via the NAT Gateway address.

And, as on Windows hosts, the host OS firewall blocks nothing. If I enable the OS X firewall and block ports, the Guests completely bypass the firewall and can access the host. I assume this is because NAT has access to the localback interface which the firewall does not block.