diff --git a/configuration/vpn.md b/configuration/vpn.md
index 131a86df..c5dbe40c 100644
--- a/configuration/vpn.md
+++ b/configuration/vpn.md
@@ -203,13 +203,15 @@ Configure your AppVMs to use the VPN VM as a NetVM...
 ![Settings-NetVM.png](/attachment/wiki/VPN/Settings-NetVM.png)
 
 
-If you want to be able to use the qubes firewall, create a ProxyVM firewall and set it to use the VPN VM as NetVM.
-Then configure AppVMs to use *that* firewall as their NetVM.
+If you want to be able to use the [Qubes firewall](/doc/firewall), create a new FirewallVM (as a ProxyVM) and set it to use the VPN VM as its NetVM.
+Then, configure AppVMs to use your new FirewallVM as their NetVM.
 
-If you want to update your Templates through the VPN, configure the ProxyVM firewall so as to enable the qubes-updates-proxy service.
-You can do this using the services tab in the Manager or at the command line:
-`qvm-service -e <name> qubes-updates-proxy`
-Then configure your templates to use the ProxyVM firewall as their NetVM.
+If you want to update your TemplateVMs through the VPN, enable the `qubes-updates-proxy` service in your new FirewallVM.
+You can do this in the Services tab in Qubes VM Manager or on the command-line:
+
+    $ qvm-service -e <name> qubes-updates-proxy
+
+Then, configure your templates to use your new FirewallVM as their NetVM.
 
 
 Troubleshooting