Setup opening firewall ports not working as documented?

[go140point6]

This probably really belongs over in the main release, but I'm putting it here for visibility. Maybe I'm misreading it but it suggests that incoming ports that need to be opened are taken care of by the installation? This is under "Become a host":

However SSL setup and hosted smart contracts requires following conditions to be met. Please note that Evernode automatically adds the required allow-rules for these ports to the operating system firewall.

But I'm not seeing that. Let's Encrypt opens port 80, I see that, but the only other port I see open is my ssh port which I opened myself.

Am I misunderstanding? Do I open the incoming port ranges myself based on the number of offered leases or does that happen dynamically later when needed? If I have to do it, I must remember to adjust when/if my offered contract instances changes? I'm using IPv6, so I assume the ports that need to be opened are for IPv6 only?

Maybe it's just me, but I think the documentation should be made a little clearer in this regard.