diff --git a/layouts/shortcodes/requirements_ports_rancher.html b/layouts/shortcodes/requirements_ports_rancher.html
index eaf601ac3b1..4d4263990f6 100644
--- a/layouts/shortcodes/requirements_ports_rancher.html
+++ b/layouts/shortcodes/requirements_ports_rancher.html
@@ -1,6 +1,6 @@
 <div>
 	<p><strong>Rancher nodes:</strong><br/>Nodes running the <code>rancher/rancher</code> container</p>
-	<h6>Rancher nodes - Inbound rules</h6>
+	<h3>Rancher nodes - Inbound rules</h3>
 	<table>
 	    <tr>
 	        <th>Protocol</th>
@@ -21,7 +21,7 @@
 	        <td>Rancher agent, Rancher UI/API, kubectl</td>
 	    </tr>
 	</table>
-	<h6>Rancher nodes - Outbound rules</h6>
+	<h3>Rancher nodes - Outbound rules</h3>
 	<table>
 	    <tr>
 	        <th>Protocol</th>
diff --git a/layouts/shortcodes/requirements_ports_rke.html b/layouts/shortcodes/requirements_ports_rke.html
index 8bf136cb8e5..f5b0491a08a 100644
--- a/layouts/shortcodes/requirements_ports_rke.html
+++ b/layouts/shortcodes/requirements_ports_rke.html
@@ -1,6 +1,6 @@
 <div>	
 	<p><strong>etcd nodes:</strong><br/>Nodes with the role <strong>etcd</strong></p>
-	<h6>etcd nodes - Inbound rules</h6>
+	<h3>etcd nodes - Inbound rules</h3>
 	<table>
 	    <tr>
 	        <th>Protocol</th>
@@ -26,6 +26,12 @@
 	        <td><ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul></td>
 	        <td>Canal/Flannel VXLAN overlay networking</td>
 	    </tr>
+	    <tr>
+		<td>TCP</td>
+	        <td>9099</td>
+	        <td><ul><li>etcd node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Canal/Flannel livenessProbe/readinessProbe</td>
+	    </tr>
 	    <tr>
 	        <td>TCP</td>
 	        <td>10250</td>
@@ -33,7 +39,7 @@
 	        <td>kubelet</td>
 	    </tr>
 	</table>
-	<h6>etcd nodes - Outbound rules</h6>
+	<h3>etcd nodes - Outbound rules</h3>
 	<table>
 	    <tr>
 	        <th>Protocol</th>
@@ -71,9 +77,15 @@
 	        <td><ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul></td>
 	        <td>Canal/Flannel VXLAN overlay networking</td>
 	    </tr>
+	    <tr>
+		<td>TCP</td>
+	        <td>9099</td>
+	        <td><ul><li>etcd node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Canal/Flannel livenessProbe/readinessProbe</td>
+	    </tr>
 	</table>
 	<p><strong>controlplane nodes:</strong><br/>Nodes with the role <strong>controlplane</strong></p>
-	<h6>controlplane nodes - Inbound rules</h6>
+	<h3>controlplane nodes - Inbound rules</h3>
 	<table>
 	    <tr>
 	        <th>Protocol</th>
@@ -105,12 +117,24 @@
 	        <td><ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul></td>
 	        <td>Canal/Flannel VXLAN overlay networking</td>
 	    </tr>
+	    <tr>
+		<td>TCP</td>
+	        <td>9099</td>
+	        <td><ul><li>controlplane node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Canal/Flannel livenessProbe/readinessProbe</td>
+	    </tr>
 	    <tr>
 	        <td>TCP</td>
 	        <td>10250</td>
 	        <td><ul><li>controlplane nodes</li></ul></td>
 	        <td>kubelet</td>
 	    </tr>
+	    <tr>
+	        <td>TCP</td>
+	        <td>10254</td>
+	        <td><ul><li>controlplane node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Ingress controller livenessProbe/readinessProbe</td>
+	    </tr>
 	    <tr>
 	        <td>TCP/UDP</td>
 	        <td>30000-32767</td>
@@ -118,7 +142,7 @@
 	        <td>NodePort port range</td>
 	    </tr>
 	</table>
-	<h6>controlplane nodes - Outbound rules</h6>
+	<h3>controlplane nodes - Outbound rules</h3>
 	<table>
 	    <tr>
 	        <th>Protocol</th>
@@ -150,15 +174,27 @@
 	        <td><ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul></td>
 	        <td>Canal/Flannel VXLAN overlay networking</td>
 	    </tr>
+	    <tr>
+		<td>TCP</td>
+	        <td>9099</td>
+	        <td><ul><li>controlplane node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Canal/Flannel livenessProbe/readinessProbe</td>
+	    </tr>
 	    <tr>
 	        <td>TCP</td>
 	        <td>10250</td>
 	        <td><ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul></td>
 	        <td>kubelet</td>
 	    </tr>
+	    <tr>
+	        <td>TCP</td>
+	        <td>10254</td>
+	        <td><ul><li>controlplane node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Ingress controller livenessProbe/readinessProbe</td>
+	    </tr>
 	</table>
 	<p><strong>worker nodes:</strong><br/>Nodes with the role <strong>worker</strong></p>
-	<h6>worker nodes - Inbound rules</h6>
+	<h3>worker nodes - Inbound rules</h3>
 	<table>
 	    <tr>
 	        <th>Protocol</th>
@@ -184,12 +220,24 @@
 	        <td><ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul></td>
 	        <td>Canal/Flannel VXLAN overlay networking</td>
 	    </tr>
+	    <tr>
+		<td>TCP</td>
+	        <td>9099</td>
+	        <td><ul><li>worker node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Canal/Flannel livenessProbe/readinessProbe</td>
+	    </tr>
 	    <tr>
 	        <td>TCP</td>
 	        <td>10250</td>
 	        <td><ul><li>controlplane nodes</li></ul></td>
 	        <td>kubelet</td>
 	    </tr>
+	    <tr>
+	        <td>TCP</td>
+	        <td>10254</td>
+	        <td><ul><li>worker node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Ingress controller livenessProbe/readinessProbe</td>
+	    </tr>
 	    <tr>
 	        <td>TCP/UDP</td>
 	        <td>30000-32767</td>
@@ -197,7 +245,7 @@
 	        <td>NodePort port range</td>
 	    </tr>
 	</table>
-	<h6>worker nodes - Outbound rules</h6>
+	<h3>worker nodes - Outbound rules</h3>
 	<table>
 	    <tr>
 	        <th>Protocol</th>
@@ -223,6 +271,21 @@
 	        <td><ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul></td>
 	        <td>Canal/Flannel VXLAN overlay networking</td>
 	    </tr>
+	    <tr>
+		<td>TCP</td>
+	        <td>9099</td>
+	        <td><ul><li>worker node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Canal/Flannel livenessProbe/readinessProbe</td>
+	    </tr>
+	    <tr>
+	        <td>TCP</td>
+	        <td>10254</td>
+	        <td><ul><li>worker node itself (local traffic, not across nodes)</li></ul>See <a href=#local-node-traffic>Local node traffic</a></td>
+	        <td>Ingress controller livenessProbe/readinessProbe</td>
+	    </tr>
 	</table>
     <br/>
+    <h3 id="local-node-traffic">Information on local node traffic</h3>
+    <p>Kubernetes healthchecks (<code>livenessProbe</code> and <code>readinessProbe</code>) are executed on the host itself. On most nodes, this is allowed by default. When you have applied strict host firewall (i.e. <code>iptables</code>) policies on the node, or when you are using nodes that have multiple interfaces (multihomed), this traffic gets blocked. In this case, you have to explicitely allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as Source or Destination in your security group, that this only applies to the private interface of the nodes/instances.
+    </p>	
 </div>