diff --git a/README.md b/README.md
index d1857c79a95affcfb0b74d765a0a98fe601a9409..9de541570d388f7d172b1083ea8b9b8999cf3502 100644
--- a/README.md
+++ b/README.md
@@ -189,9 +189,10 @@ The autoradio HTTP server can operate in one of two modes:
 ## Firewalls
 
 The users should be able to reach ports 53/tcp, 53/udp, 80/tcp and
-8000/tcp on all nodes. Nodes should be able to reach 4001/tcp and
-4002/tcp on each other; these two ports can be public if you've set up
-X509-based authentication to etcd.
+8000/tcp (unless proxying is enabled) on all nodes. Nodes should be
+able to reach 2379/tcp and 2380/tcp (the etcd ports) on each other;
+these two ports can be public if you've set up X509-based
+authentication for etcd.
 
 
 ## Securing etcd