improve firewall comment

examples/demo-firewall.nix

@@ -233,9 +233,9 @@ in {
     type = "filter";
     family = "ip";
     rules = [
-      # this is where you put permitted incoming
+      # This is where you put permitted incoming connections. If
-      # connections. Practically there's not a lot of use for this
+      # you're using NAT, the rules in this chain will see the
-      # chain unless you have routable ipv4 addresses
+      # internal (RFC1918) addresses.
     ];
   };