When you do not want the virtual machines in a vApp to connect to objects outside the vApp, you must create an isolated vApp network.

Prerequisites

Verify that you are connected to a vCloud Director server.

Procedure
1

Retrieve the vApp for which you want to create a vApp network. 

$myVApp = Get-CIVApp -Name 'MyVApp'
2

Create the new vApp network with a selected gateway and network mask. 

New-CIVAppNetwork -VApp $myVApp -Name 'MyVAppInternalNetwork' -Routed -Gateway '192.168.2.1' -Netmask '255.255.255.0' -ParentOrgVdcNetwork $null

By default, the vApp network has an enabled firewall.