fix note to indicate that WAN interface is ALWAYS excluded