diff --git a/src/ca/CAref.html b/src/ca/CAref.html
index 743f44bdd..30e8127d4 100644
--- a/src/ca/CAref.html
+++ b/src/ca/CAref.html
@@ -455,7 +455,7 @@ Environment</a> below.</p>
 <h3><a name="firewall">Firewalls</a></h3>
 
 <p>If you want channel access clients on a machine to be able to see
-beacons and replies to broadcast PV search requests you need to permit
+beacons and replies to broadcast PV search requests, you need to permit
 inbound UDP packets with source port EPICS_CA_SERVER_PORT (default is 5064)
 or destination port EPICS_CA_REPEATER_PORT (default is 5065). On systems
 using iptables this can be accomplished by rules like</p>
@@ -466,9 +466,9 @@ using iptables this can be accomplished by rules like</p>
 </pre>
 
 <p>If you want channel access servers (e.g. "soft IOCs") on a machine to be
-able to see clients you need to permit inbound TCP or UDP packets with source
-port EPICS_CA_SERVER_PORT (default is 5064).  On systems using iptables this
-can be accomplished by rules like</p>
+able to be seen by clients, you need to permit inbound TCP or UDP packets with
+destination port EPICS_CA_SERVER_PORT (default is 5064).
+On systems using iptables this can be accomplished by rules like</p>
 
 <pre>
      -A INPUT -s 192.168.0.0/22 -p udp --dport 5064 -j ACCEPT