docs: note that the routing peer decrypts traffic before forwarding it

This commit is contained in:
Jack Carter
2026-10-16 16:01:57 +02:00
parent a16bdc22d9
commit 14a79a3256
+1 -1
View File
@@ -90,7 +90,7 @@ A network resource policy grants access to the network **behind** the routing pe
Here is the whole path, end to end:
1. Your client encrypts the packet and sends it through the tunnel to the routing peer.
2. The routing peer forwards it onto the local network toward the resource.
2. The routing peer decrypts the packet and forwards it onto the local network toward the resource.
3. By default the routing peer **masquerades** the traffic, rewriting the source to its own LAN IP, so the destination network needs no awareness of NetBird.
4. Replies follow the reverse path. The connection is stateful, so return traffic needs no extra policy.