diff --git a/doc/config.md b/doc/config.md
index 150fb5b..7a236eb 100644
--- a/doc/config.md
+++ b/doc/config.md
@@ -84,22 +84,18 @@ processes.
 Alternatively, you may use filesystem capabilities instead
 of starting sslh as root and asking it to drop privileges.
 You will need `CAP_NET_BIND_SERVICE` for listening on port 443
-and `CAP_NET_ADMIN` for transparent proxying (see
+and `CAP_NET_RAW` for transparent proxying (see
 `capabilities(7)`).
 
 You can use the `setcap(8)` utility to give these capabilities
 to the executable:
 
-	sudo setcap cap_net_bind_service,cap_net_admin+pe sslh-select
+	sudo setcap cap_net_bind_service,cap_net_raw+pe sslh-select
 
 Then you can run sslh-select as an unpriviledged user, e.g.:
 
 	sslh-select -p myname:443 --ssh localhost:22 --ssl localhost:443
 
-Caveat: `CAP_NET_ADMIN` does give sslh too many rights, e.g.
-configuring the interface. If you're not going to use
-transparent proxying, just don't use it (or use the libcap method).
-
 Transparent proxy support
 -------------------------
 
@@ -126,7 +122,7 @@ but to the network setup that surrounds it.
 Linux:
 
 `sslh` needs extended rights to perform this: you'll need to
-give it `CAP_NET_ADMIN` capabilities (see appropriate chapter)
+give it `CAP_NET_RAW` capabilities (see appropriate chapter)
 or run it as root (but don't do that).
 
 The firewalling tables also need to be adjusted as follows.
@@ -286,7 +282,7 @@ Example service unit:
 	[Service]
 	ExecStart=/usr/sbin/sslh -v -f --ssh 127.0.0.1:22 --ssl 127.0.0.1:443
 	KillMode=process
-	CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN CAP_SETGID CAP_SETUID
+	CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_RAW
 	PrivateTmp=true
 	PrivateDevices=true
 	ProtectSystem=full
diff --git a/scripts/etc.sysconfig.sslh b/scripts/etc.sysconfig.sslh
index d9eeed5..72d04b2 100644
--- a/scripts/etc.sysconfig.sslh
+++ b/scripts/etc.sysconfig.sslh
@@ -9,7 +9,7 @@
 # is needed in order to run as sslh user
 #
 #SSLH_USER=sslh
-#setcap cap_net_bind_service,cap_net_admin=+ep $SSLH
+#setcap cap_net_bind_service,cap_net_raw=+ep $SSLH
 
 #
 # Configuration file for sslh
diff --git a/scripts/systemd.sslh.service b/scripts/systemd.sslh.service
index 3e5cd14..a6a6bb9 100644
--- a/scripts/systemd.sslh.service
+++ b/scripts/systemd.sslh.service
@@ -8,7 +8,7 @@ ExecStart=/usr/sbin/sslh --foreground $DAEMON_OPTS
 KillMode=process
 #Hardening
 PrivateTmp=true
-CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 SecureBits=noroot-locked
 ProtectSystem=strict