diff --git a/examples/config.yml b/examples/config.yml
index 32157ab1..dc18aa1e 100644
--- a/examples/config.yml
+++ b/examples/config.yml
@@ -459,7 +459,8 @@ firewall:
   # - port: Takes `0` or `any` as any, a single number `80`, a range `200-901`, or `fragment` to match second and further fragments of fragmented packets (since there is no port available).
   #   proto: `any`, `tcp`, `udp`, or `icmp`
   #          a port specification is ignored if proto is `icmp`
-  #          only tcp and udp packets have ports, packets of any other protocol only match port `any` or `fragment`
+  #          Nebula only reads ports from tcp and udp, so a proto `any` rule with a specific port or range only matches tcp and udp traffic.
+  #          Other protocols (gre, esp, sctp, etc) need port `any`.
   #   host: `any` or a literal hostname, ie `test-host`
   #   group: `any` or a literal group name, ie `default-group`
   #   groups: Same as group but accepts a list of values. Multiple values are AND'd together and a certificate would have to contain all groups to pass