diff --git a/configuration/vpn.md b/configuration/vpn.md
index 72fa2eda..c5dbe40c 100644
--- a/configuration/vpn.md
+++ b/configuration/vpn.md
@@ -202,6 +202,18 @@ Configure your AppVMs to use the VPN VM as a NetVM...
 
 ![Settings-NetVM.png](/attachment/wiki/VPN/Settings-NetVM.png)
 
+
+If you want to be able to use the [Qubes firewall](/doc/firewall), create a new FirewallVM (as a ProxyVM) and set it to use the VPN VM as its NetVM.
+Then, configure AppVMs to use your new FirewallVM as their NetVM.
+
+If you want to update your TemplateVMs through the VPN, enable the `qubes-updates-proxy` service in your new FirewallVM.
+You can do this in the Services tab in Qubes VM Manager or on the command-line:
+
+    $ qvm-service -e <name> qubes-updates-proxy
+
+Then, configure your templates to use your new FirewallVM as their NetVM.
+
+
 Troubleshooting
 ---------------