[PATCH docs v2] pve-firewall: link to implicit rules section.

[PATCH docs v2] pve-firewall: link to implicit rules section.

[Manuel Federanko]

Updated the documentation note to link to the default rules.
Also added a section directing users to the macro system if they need
additional rules.

Add a note to the Ceph section that the firewall has to be configured,
if it is enabled.

Suggested-by: Friedrich Weber <f.weber@proxmox.com>
Signed-off-by: Manuel Federanko <m.federanko@proxmox.com>
---
 pve-firewall.adoc | 14 +++++++++++---
 pveceph.adoc      |  3 +++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/pve-firewall.adoc b/pve-firewall.adoc
index f04134a..21608c9 100644
--- a/pve-firewall.adoc
+++ b/pve-firewall.adoc
@@ -172,9 +172,15 @@ set the enable option here:
 enable: 1
 ----
 
-IMPORTANT: If you enable the firewall, traffic to all hosts is blocked by
-default. Only exceptions is WebGUI(8006) and ssh(22) from your local
-network.
+IMPORTANT: If you enable the firewall, traffic to all hosts will be
+blocked by default - with some exceptions for traffic coming from the
+local network to the WebUI, SSH and other important services. A full
+list of the default firewall rules can be found at
+xref:pve_firewall_default_rules.
+
+Should you have other services running which communicate over the
+network, you will have to allow them seperately. For some common
+services there are `macros` available.
 
 If you want to administrate your {pve} hosts from remote, you
 need to create rules to allow traffic from those remote IPs to the web
@@ -510,6 +516,8 @@ following traffic is still allowed for all {pve} hosts in the cluster:
 * TCP traffic from management hosts to port 3128 for connections to the SPICE
   proxy
 * TCP traffic from management hosts to port 22 to allow ssh access
+* TCP traffic from management hots to the port range 60000 to 60050 allowing
+  traffic for migrations
 * UDP traffic in the cluster network to ports 5405-5412 for corosync
 * UDP multicast traffic in the cluster network
 * ICMP traffic type 3 (Destination Unreachable), 4 (congestion control) or 11
diff --git a/pveceph.adoc b/pveceph.adoc
index fc8a072..05b21bb 100644
--- a/pveceph.adoc
+++ b/pveceph.adoc
@@ -180,6 +180,9 @@ high-performance setups:
 * one medium bandwidth (1 Gbps) exclusive for the latency sensitive corosync
   cluster communication.
 
+If a firewall is enabled you will have to open the ports used by Ceph, the
+easiest way to do this is to use a firewall `macro`.
+
 [[pve_ceph_recommendation_disk]]
 .Disks
 When planning the size of your Ceph cluster, it is important to take the
-- 
2.47.3