document --host

and add some broader points about access control early on, since some
users will wonder about that right from the start.

Fixes #2347

site/using-weave.md

@@ -69,6 +69,17 @@ For example:
 
 Peers can also be dynamically added. See [Adding Hosts Dynamically](/site/using-weave/finding-adding-hosts-dynamically.md) for more information.
 
+####Restricting Access
+
+By default Weave Net will listen on all host IPs (i.e. 0.0.0.0). This
+can be altered with the `--host` parameter to `weave launch`, e.g. in
+order to ensure Weave Net only listens on IPs on an internal network.
+
+Standard firewall rules can be deployed to restrict access to the
+Weave Net control and data ports.
+
+For communication across untrusted networks, connections can be
+[encrypted](/site/using-weave/security-untrusted-networks.md).
 
 ###<a name="testing"></a>Testing Container Communications
 

weave

@@ -41,6 +41,7 @@ weave --help | help
 
 weave launch        <same arguments as 'weave launch-router'>
       launch-router [--password <pass>] [--trusted-subnets <cidr>,...]
+                      [--host <ip_address>]
                       [--name <mac>] [--nickname <nickname>]
                       [--no-restart] [--resume] [--no-discovery] [--no-dns]
                       [--ipalloc-init <mode>]