Add firewall warning on installation page

site/faq.md

@@ -104,7 +104,8 @@ Yes, of course!  Weave allows you to run isolated networks and still allow open
 You must permit traffic to flow through TCP 6783 and UDP 6783/6784,
 which are Weave’s control and data ports.
 
-The daemon also uses TCP port 6782 for [metrics](/site/tasks/manage/metrics.md), but
+The daemon also uses TCP 6781/6782 for
+[metrics](/site/tasks/manage/metrics.md#metrics-endpoint-addresses), but
 you would only need to open up this port if you wish to collect metrics
 from another host.
 

site/kubernetes/kube-addon.md

@@ -22,6 +22,10 @@ The following topics are discussed:
 
 ## <a name="install"></a> Installation
 
+*Before installing Weave Net, you should make sure the following ports are not
+blocked by your firewall: TCP 6783 and UDP 6783/6784.
+For more details, see the [FAQ](/site/faq.md#ports).*
+
 Weave Net can be installed onto your CNI-enabled Kubernetes cluster
 with a single command: