doc: ceph-iscsi-api ports should not be public facing

Signed-off-by: Jason Dillaman <dillaman@redhat.com>

diff --git a/doc/rbd/iscsi-target-cli.rst b/doc/rbd/iscsi-target-cli.rst
index 28a1d9af05a1925e222cded72b25a822f7fbb5bd..faba49412135288896aea5e4717b77c0f61ee809 100644 (file)
--- a/doc/rbd/iscsi-target-cli.rst
+++ b/doc/rbd/iscsi-target-cli.rst
@@ -43,6 +43,11 @@ to the *Installing* section:
 
 #. If needed, open TCP ports 3260 and 5000 on the firewall.
 
+   .. note::
+      Access to port 5000 should be restricted to a trusted internal network or
+      only the individual hosts where ``gwcli`` is used or ``ceph-mgr`` daemons
+      are running.
+
 #. Create a new or use an existing RADOS Block Device (RBD).
 
 **Installing:**