diff --git a/proxy/tun/README.md b/proxy/tun/README.md
index 183b7a156..c4235bf26 100644
--- a/proxy/tun/README.md
+++ b/proxy/tun/README.md
@@ -236,7 +236,7 @@ Setting `autoSystemWfpBlockLeak` to at least `["dns"]` is recommended, to block
 - `"all"`: everything, in both directions. Access to the local network then breaks unless it is routed into the TUN as well, and so do incoming connections to other programs, other VPNs, and virtual machines whose NAT runs on the host.
 - `"allexceptlan"`: like `"all"`, but traffic to and from the local network stays allowed, e.g. for printers or casting to a TV: private, link-local, multicast and broadcast addresses (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `224.0.0.0/4`, `255.255.255.255`, `fc00::/7`, `fe80::/10`, `ff00::/8`), not global IPv6 ones. It includes `"dns"`, and the other values apply there as well. `"all"` overrides it.
 
-Any value can be limited to one IP version with `"ipv4:"` or `"ipv6:"` in front, e.g. `"ipv4:udp/53"` or `"ipv6:all"`.
+Any value can be limited to one IP version with `"ipv4:"` or `"ipv6:"` in front, e.g. `"ipv4:udp/53"` or `"ipv6:all"`. `"ipv4:allexceptlan"`, for instance, includes `"ipv4:dns"` only; add `"dns"` to block DNS over IPv6 as well.
 
 Loopback, DHCP, DHCPv6 and IPv6 neighbor discovery always stay allowed. Xray's own connections out also get past Windows Firewall's block rules, while connections to its inbounds stay subject to them. If the filters cannot be added, Xray does not start; they are removed when it exits. Name resolution on the local network (LLMNR, mDNS, NetBIOS) is not covered, except over an IP version that is blocked entirely.