diff --git a/index.mdx b/index.mdx
index 727d807..67fde29 100644
--- a/index.mdx
+++ b/index.mdx
@@ -14,7 +14,7 @@ Pangolin establishes secure connections from edge networks to nodes, bypassing t
   <Card title="How it works" icon="map" href="/about/how-pangolin-works">
     Learn how the Pangolin system works from the server to the edge network.
   </Card>
-  <Card title="nodes" icon="circle-nodes" href="/manage/nodes">
+  <Card title="Nodes" icon="circle-nodes" href="/manage/nodes">
     Learn about how Pangolin provides highly available ingress to your backend.
   </Card>
 </Columns>
diff --git a/manage/clients/add-client.mdx b/manage/clients/add-client.mdx
index 68492b5..0bd036c 100644
--- a/manage/clients/add-client.mdx
+++ b/manage/clients/add-client.mdx
@@ -139,15 +139,40 @@ In native mode, you can add remote subnets to the site settings in Pangolin to f
 
 This will configure a route on the Olm side of the tunnel to route this subnet down the tunnel. When it reaches the other end, can be routed to the appropriate destination by the host.
 
-This may require Linux that you have forwarding enabled:
+This requires proper Linux routing configuration. Here's what happens in native mode:
 
+1. **Olm forwards packets**: Your computer running Olm blindly forwards all packets destined for the remote subnet (e.g., 192.168.0.x) over the tunnel
+2. **Newt receives packets**: Newt creates a WireGuard network interface on the Linux host and receives these packets
+3. **Linux must route packets**: The Linux machine needs to know what to do with packets destined for 192.168.0.x
+
+#### Required Configuration
+
+**Enable IP forwarding:**
 ```bash
 sudo nano /etc/sysctl.conf
 
 net.ipv4.ip_forward = 1
 ```
 
-...and [setup NAT](https://www.geeksforgeeks.org/linux-unix/using-masquerading-with-iptables-for-network-address-translation-nat/) or other routing so that destination networks can route back to the Olm client. Remember the source address of the packets will be the IP address of the Olm client in this situation and the destination will be an IP on the remote subnet network.
+**Setup NAT masquerading:**
+```bash
+sudo iptables -t nat -A POSTROUTING -j MASQUERADE
+```
+
+This rewrites the source address of packets from the tunnel to be the 192.168.0.x address of the Linux instance when packets leave the instance. This way, when devices on 192.168.0.x reply to the Olm client, they know to send the response back through the tunnel.
+
+#### Troubleshooting Routing Issues
+
+If you can connect to Newt (peer shows as connected in logs) but can't reach remote subnet resources:
+
+1. **Check if packets reach the destination**: The connection to Newt is working, so this is likely a routing issue
+2. **Verify forwarding is enabled**: Use `sysctl net.ipv4.ip_forward` to confirm it's set to 1
+3. **Check iptables rules**: Ensure NAT masquerading is configured
+4. **Consider using proxy mode**: [Client resources](../resources/client-resources.mdx) can be easier as Newt handles the proxying, though you'll need to address everything as the Newt IP and assign specific ports
+
+<Note>
+NAT masquerading can affect other services on the Linux instance, so be aware of potential conflicts with existing network configurations.
+</Note>
 
 ## Notes