diff --git a/site/using-weave.md b/site/using-weave.md
index 2eb55340..ccc76988 100644
--- a/site/using-weave.md
+++ b/site/using-weave.md
@@ -69,6 +69,17 @@ For example:
 
 Peers can also be dynamically added. See [Adding Hosts Dynamically](/site/using-weave/finding-adding-hosts-dynamically.md) for more information.
 
+####Restricting Access
+
+By default Weave Net listens on all host IPs (i.e. 0.0.0.0). This
+can be altered with the `--host` parameter to `weave launch`, for example, 
+to ensure that Weave Net only listens on IPs on an internal network.
+
+Standard firewall rules can be deployed to restrict access to the
+Weave Net control and data ports.
+
+For communication across untrusted networks, connections can be
+[encrypted](/site/using-weave/security-untrusted-networks.md).
 
 ###<a name="testing"></a>Testing Container Communications
 
diff --git a/weave b/weave
index a5da7089..0e3ed19c 100755
--- a/weave
+++ b/weave
@@ -41,6 +41,7 @@ weave --help | help
 
 weave launch        <same arguments as 'weave launch-router'>
       launch-router [--password <pass>] [--trusted-subnets <cidr>,...]
+                      [--host <ip_address>]
                       [--name <mac>] [--nickname <nickname>]
                       [--no-restart] [--resume] [--no-discovery] [--no-dns]
                       [--ipalloc-init <mode>]