diff --git a/README.md b/README.md
index e8c3ec7d..253e8e83 100644
--- a/README.md
+++ b/README.md
@@ -66,6 +66,15 @@ yum install -y rubygem-ronn-ng
 See [README-radius](doc/README-radius.md) for more information on Radius
 dependencies and its configuration.
 
+# Runtime dependencies
+
+When the `restrict-user-to-routes` or `restrict-user-to-ports` options are
+configured, ocserv invokes `/usr/libexec/ocserv-fw` at runtime to enforce
+firewall rules. That script requires either `nft` (nftables) or `iptables`
+depending on the backend selected with the `-Dfirewall-script=` meson option
+at build time. The default is `nftables` when `nft` is present at configure
+time, otherwise `iptables`.
+
 # Build instructions
 
 ```
diff --git a/doc/sample.config b/doc/sample.config
index b0d51def..953af3c1 100644
--- a/doc/sample.config
+++ b/doc/sample.config
@@ -688,10 +688,13 @@ no-route = 192.168.5.0/255.255.255.0
 #no-udp = false
 
 # If set, the script /usr/libexec/ocserv-fw will be called to restrict
-# the user to its allowed routes and prevent him from accessing
+# the user to its allowed routes and prevent them from accessing
 # any other routes. In case of defaultroute, the no-routes are restricted.
 # All the routes applied by ocserv can be reverted using /usr/libexec/ocserv-fw
 # --removeall. This option can be set globally or in the per-user configuration.
+#
+# Note: the ocserv-fw script requires either nft (nftables) or iptables at runtime,
+# depending on the backend selected with -Dfirewall-script= at build time.
 # [scope: vhost user]
 #restrict-user-to-routes = true