The rsync server port (over stunnel) is open to the IP addresses defined by the value of $client_nets, which for most installs is the local network.
$client_nets
References: AC-4