Add TROUBLESHOOTING section in man page

docs/re6stnet.rst

@@ -137,6 +137,27 @@ Its IP is the first unicast address::
   re6st-registry --private 2001:db8:42::1 ...
   re6stnet --registry http://localhost/ --ip re6st.example.com ...
 
+TROUBLESHOOTING
+===============
+
+On networks with very few working nodes compared to the total number of
+registered nodes, it may take some time to bootstrap. However, if you really
+think something goes wrong, you should first enable OpenVPN logs and increase
+verbosity: see commented directives in configuration generated by `re6st-conf`.
+
+A common failure is caused by a misconfigured firewall:
+
+- re6st launches several OpenVPN processes. Those in client mode may connect to
+  any TCP/UDP port in IPv4. Server processes only listen to ports specified
+  by ``--pp`` option.
+
+- OpenVPN always aborts due to inactivity timeout when Babel paquets are
+  filtered. UDP port 6696 must be open on link-local IPv6 of all interfaces
+  managed by Babel.
+
+Other security components may also break re6st. For example, default SELinux
+configuration on Fedora prevents execution of OpenVPN server processes.
+
 SEE ALSO
 ========