gui, man: Update docs & translations

man/strelaysrv.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "STRELAYSRV" "1" "October 05, 2016" "v0.14" "Syncthing"
+.TH "STRELAYSRV" "1" "October 16, 2016" "v0.14" "Syncthing"
 .SH NAME
 strelaysrv \- Syncthing Relay Server
 .
@@ -193,6 +193,32 @@ firewall.
 .sp
 Another option is \fI\%described here\fP <\fBhttps://wiki.apache.org/httpd/NonRootPortBinding\fP>,
 although your milage may vary.
+.SH FIREWALL CONSIDERATIONS
+.sp
+The relay server listens on two ports by default.  One for data connections and the other
+for providing public statistics at \fI\%https://relays.syncthing.net\fP\&.  The firewall, such as
+\fBiptables\fP, must permit incoming TCP connetions to the following ports:
+.INDENT 0.0
+.IP \(bu 2
+Data port:  \fB22067/tcp\fP overriden with \fB\-listen\fP and advertised with \fB\-ext\-address\fP
+.IP \(bu 2
+Status port: \fB22070/tcp\fP overriden with \fB\-status\-srv\fP
+.UNINDENT
+.sp
+Runtime \fBiptables\fP rules to allow access to the default ports:
+.INDENT 0.0
+.INDENT 3.5
+.sp
+.nf
+.ft C
+iptables \-I INPUT \-p tcp \-\-dport 22067 \-j ACCEPT
+iptables \-I INPUT \-p tcp \-\-dport 22070 \-j ACCEPT
+.ft P
+.fi
+.UNINDENT
+.UNINDENT
+.sp
+Please consult Linux distribution documentation to persist firewall rules.
 .SH SEE ALSO
 .sp
 \fIsyncthing\-relay(7)\fP, \fIsyncthing\-faq(7)\fP,