From 14a79a32565f1782d94d659ebe4ac5b1a7a9d1ef Mon Sep 17 00:00:00 2001
From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
Date: Fri, 16 Oct 2026 16:01:57 +0200
Subject: [PATCH] docs: note that the routing peer decrypts traffic before
 forwarding it

---
 src/pages/manage/networks/index.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pages/manage/networks/index.mdx b/src/pages/manage/networks/index.mdx
index 2a970ff6..4ec8f9c3 100644
--- a/src/pages/manage/networks/index.mdx
+++ b/src/pages/manage/networks/index.mdx
@@ -90,7 +90,7 @@ A network resource policy grants access to the network **behind** the routing pe
 Here is the whole path, end to end:
 
 1. Your client encrypts the packet and sends it through the tunnel to the routing peer.
-2. The routing peer forwards it onto the local network toward the resource.
+2. The routing peer decrypts the packet and forwards it onto the local network toward the resource.
 3. By default the routing peer **masquerades** the traffic, rewriting the source to its own LAN IP, so the destination network needs no awareness of NetBird.
 4. Replies follow the reverse path. The connection is stateful, so return traffic needs no extra policy.