From 72e92db96ee9c6f924b742d0323c7772ad2f2140 Mon Sep 17 00:00:00 2001
From: Matthias Radestock <matthias.radestock@gmail.com>
Date: Wed, 29 Jun 2016 20:09:02 +0100
Subject: [PATCH] document --host

and add some broader points about access control early on, since some
users will wonder about that right from the start.

Fixes #2347
---
 site/using-weave.md | 11 +++++++++++
 weave               |  1 +
 2 files changed, 12 insertions(+)

diff --git a/site/using-weave.md b/site/using-weave.md
index 2eb55340..c8a1bea8 100644
--- a/site/using-weave.md
+++ b/site/using-weave.md
@@ -69,6 +69,17 @@ For example:
 
 Peers can also be dynamically added. See [Adding Hosts Dynamically](/site/using-weave/finding-adding-hosts-dynamically.md) for more information.
 
+####Restricting Access
+
+By default Weave Net will listen on all host IPs (i.e. 0.0.0.0). This
+can be altered with the `--host` parameter to `weave launch`, e.g. in
+order to ensure Weave Net only listens on IPs on an internal network.
+
+Standard firewall rules can be deployed to restrict access to the
+Weave Net control and data ports.
+
+For communication across untrusted networks, connections can be
+[encrypted](/site/using-weave/security-untrusted-networks.md).
 
 ###<a name="testing"></a>Testing Container Communications
 
diff --git a/weave b/weave
index 0887b3e2..73f49b88 100755
--- a/weave
+++ b/weave
@@ -41,6 +41,7 @@ weave --help | help
 
 weave launch        <same arguments as 'weave launch-router'>
       launch-router [--password <pass>] [--trusted-subnets <cidr>,...]
+                      [--host <ip_address>]
                       [--name <mac>] [--nickname <nickname>]
                       [--no-restart] [--resume] [--no-discovery] [--no-dns]
                       [--ipalloc-init <mode>]