diff --git a/console/novncd b/console/novncd
index cff4376..0fedb85 100755
--- a/console/novncd
+++ b/console/novncd
@@ -154,7 +154,8 @@ class CompatibilityMixIn(object):
             self.msg('Try to open local socket %s' % console_socket)
             tsock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
             tsock.connect(console_socket)
-        elif console_socket or re.match('^127\.', console_host):
+        # only need a tunnel to physical host if host is not localhost
+        elif connhost != "localhost" and (console_socket or re.match('^127\.', console_host)):
             # Need tunnel to physical host
             if conntype != CONN_SSH:
                 self.msg("Need a tunnel to access console but can't mount " +
diff --git a/instances/templates/instance.html b/instances/templates/instance.html
index c3baecc..381159f 100644
--- a/instances/templates/instance.html
+++ b/instances/templates/instance.html
@@ -573,6 +573,25 @@
                                                             </div>
                                                         </div>
                                                     </form>
+                                                    <p>{% trans "To change VNC listen status, shutdown the instance." %}</p>
+                                                    <form class="form-horizontal" method="post" role="form">{% csrf_token %}
+                                                        <div class="form-group">
+                                                            <div class="col-sm-offset-2 col-sm-6">
+                                                                <div class="checkbox">
+                                                                    <label>
+                                                                        <input type="checkbox" name="listen_locally" value="true" id="console_listen_locally" {% if console_listen_locally %}checked="checked"{% endif %}>{% trans "Listen only locally (127.0.0.1)" %}
+                                                                    </label>
+                                                                </div>
+                                                            </div>
+                                                            <div class="col-sm-3">
+                                                                {% ifequal status 5 %}
+                                                                    <button type="submit" class="btn btn-success" name="set_console_listen_addr">{% trans "Set" %}</button>
+                                                                {% else %}
+                                                                    <button class="btn btn-success disabled" name="set_console_listen_addr">{% trans "Set" %}</button>
+                                                                {% endifequal %}
+                                                            </div>
+                                                        </div>
+                                                    </form>
                                                     <p>{% trans "To create console password, shutdown the instance." %}</p>
                                                     <form class="form-horizontal" method="post" role="form">{% csrf_token %}
                                                         <div class="form-group">
diff --git a/instances/views.py b/instances/views.py
index 8d9afd9..116bc0c 100644
--- a/instances/views.py
+++ b/instances/views.py
@@ -223,6 +223,7 @@ def instance(request, compute_id, vname):
         has_managed_save_image = conn.get_managed_save_image()
         clone_disks = show_clone_disk(disks)
         console_passwd = conn.get_console_passwd()
+        console_listen_locally = conn.get_console_listen_addr() in ["127.0.0.1", "::1"]
 
         try:
             instance = Instance.objects.get(compute_id=compute_id, name=vname)
@@ -417,6 +418,16 @@ def instance(request, compute_id, vname):
                         addlogmsg(request.user.username, instance.name, msg)
                         return HttpResponseRedirect(request.get_full_path() + '#xmledit')
 
+                if 'set_console_listen_addr' in request.POST:
+                    console_listen_locally = request.POST.get("listen_locally", False) == "true"
+                    if not conn.set_console_listen_addr('127.0.0.1' if console_listen_locally else '0.0.0.0'):
+                        msg = _("Error setting console listen status. You should check that your instance have an graphic device.")
+                        error_messages.append(msg)
+                    else:
+                        msg = _("Set VNC listen status")
+                        addlogmsg(request.user.username, instance.name, msg)
+                        return HttpResponseRedirect(request.get_full_path() + '#vncsettings')
+
                 if 'set_console_passwd' in request.POST:
                     if request.POST.get('auto_pass', ''):
                         passwd = ''.join([choice(letters + digits) for i in xrange(12)])
diff --git a/vrtManager/create.py b/vrtManager/create.py
index cc1f7f2..5488240 100644
--- a/vrtManager/create.py
+++ b/vrtManager/create.py
@@ -227,8 +227,8 @@ class wvmCreate(wvmConnect):
 
         xml += """  <input type='mouse' bus='ps2'/>
                     <input type='tablet' bus='usb'/>
-                    <graphics type='%s' port='-1' autoport='yes' listen='0.0.0.0'>
-                      <listen type='address' address='0.0.0.0'/>
+                    <graphics type='%s' port='-1' autoport='yes' listen='127.0.0.1'>
+                      <listen type='address' address='127.0.0.1'/>
                     </graphics>
                     <console type='pty'/>
                     <video>
diff --git a/vrtManager/instance.py b/vrtManager/instance.py
index 0f3b258..eaac242 100644
--- a/vrtManager/instance.py
+++ b/vrtManager/instance.py
@@ -435,6 +435,25 @@ class wvmInstance(wvmConnect):
                     return "127.0.0.1"
         return listen_addr
 
+    def set_console_listen_addr(self, addr):
+        xml = self._XMLDesc(VIR_DOMAIN_XML_SECURE)
+        root = ElementTree.fromstring(xml)
+        console_type = self.get_console_type()
+        try:
+            graphic = root.find("devices/graphics[@type='%s']" % console_type)
+        except SyntaxError:
+            # Little fix for old version ElementTree
+            graphic = root.find("devices/graphics")
+        if graphic is None:
+            return False
+        listen = graphic.find("listen")
+        graphic.set('listen', addr)
+        if listen is not None:
+            listen.set('address', addr)
+        newxml = ElementTree.tostring(root)
+        return self._defineXML(newxml)
+
+
     def get_console_socket(self):
         socket = util.get_xml_path(self._XMLDesc(0),
                                    "/domain/devices/graphics/@socket")