diff --git a/manpages/shorewall-rules.xml b/manpages/shorewall-rules.xml
index 54f04515e..52d4df621 100644
--- a/manpages/shorewall-rules.xml
+++ b/manpages/shorewall-rules.xml
@@ -591,15 +591,26 @@
           intra-zone traffic is affected.</para>
 
           <para>If the DEST <replaceable>zone</replaceable> is a bport zone,
-          then the SOURCE <replaceable>zone</replaceable> must be
-          <option>all</option>, another bport zone associated with the same
-          bridge, or it must be an ipv4 zone that is associated with only the
-          same bridge.</para>
+          then either:<itemizedlist>
+              <listitem>
+                <para>the SOURCE must be <option>all[+][-]</option>, or</para>
+              </listitem>
+
+              <listitem>
+                <para>the SOURCE <replaceable>zone</replaceable> must be
+                another bport zone associated with the same bridge, or</para>
+              </listitem>
+
+              <listitem>
+                <para>the SOURCE <replaceable>zone</replaceable> must be an
+                ipv4 zone that is associated with only the same bridge.</para>
+              </listitem>
+            </itemizedlist></para>
 
           <para>Except when <emphasis role="bold">all</emphasis>[<emphasis
-          role="bold">+</emphasis>] is specified, the server may be further
-          restricted to a particular network, host or interface by appending
-          ":" and the network, host or interface. See <emphasis
+          role="bold">+]|[-</emphasis>] is specified, the server may be
+          further restricted to a particular network, host or interface by
+          appending ":" and the network, host or interface. See <emphasis
           role="bold">SOURCE</emphasis> above.</para>
 
           <para>You may exclude certain hosts from the set already defined