docs: document the fallback when the client cannot manage firewall rules (#964)

* docs: document the fallback when the client cannot manage firewall rules

Add a troubleshooting section for hosts that are missing the netfilter
modules the client's firewall rules depend on, such as the mark match used
for policy routing or ipset. Include the client log excerpt so the error is
findable by search, with timestamps, hostname and peer identifiers removed.

Document what actually happens. The client logs the failure and proceeds
with the userspace packet filter, so NetBird keeps working and keeps
filtering, and on a routing peer the forwarding path moves to userspace as
well. Remedies are ordered from narrowest to broadest, starting with
loading the missing module and the related environment variables before
reaching for --disable-firewall.

Warn that --disable-firewall is not the same as that automatic fallback.
The userspace filter does not take over, so NetBird enforces no access
control on the peer, and the operator has to recreate the restrictions with
the host's own firewall.

Reference the new section from the Synology install page, where these
netfilter match modules can be missing alongside the tun module already
covered there.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs: reword the NB_USE_LEGACY_ROUTING line

Address CodeRabbit review: 'ip-rule based routing' was an incorrectly
hyphenated compound modifier. Reword so the sentence describes the fallback
directly and drops the compound modifier.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

src/pages/get-started/install/synology.mdx

@@ -51,6 +51,13 @@ fi
 ```
 4. If you’d like to see the logs for this task, select the task you create and click on Settings. Check the box that says Save output results, select a save location, and click OK. Now, if you select the task and **Action > View Result**, you’ll see any error logs and status.
 
+<Note>
+    Synology devices do not always expose every kernel module NetBird uses. Alongside the `tun` module above, the
+    netfilter match modules behind the client's firewall rules can be missing, `mark` and `ipset` in particular. The
+    client then logs a `failed to create native firewall` warning and falls back to userspace filtering. See
+    [When the client cannot manage firewall rules](/help/troubleshooting-client#when-the-client-cannot-manage-firewall-rules).
+</Note>
+
 ## Running with a Setup Key
 In case you are activating a server peer, you can use a [setup key](/manage/peers/register-machines-using-setup-keys) as described in the steps below.
 > This is especially helpful when you are running multiple server instances with infrastructure-as-code tools like ansible and terraform.

src/pages/help/troubleshooting-client.mdx

@@ -493,6 +493,67 @@ sudo netbird service stop
 sudo bash -c 'NB_WG_KERNEL_DISABLED=true netbird up -F'  > /tmp/netbird.log
 ```
 
+## When the client cannot manage firewall rules
+
+On Linux the client installs its own `nftables` or `iptables` rules to filter traffic and, on a routing peer, to forward
+routed traffic. Some hosts are missing the netfilter modules those rules depend on, such as the `mark` match used for
+policy routing or `ipset` used to match sets of addresses. The client reports this and carries on without the native
+firewall:
+
+```
+WARN client/firewall/create_linux.go:55: failed to create native firewall:
+init firewall: router init: create containers: add static nat rules:
+add outbound masquerade rule: running [/sbin/iptables -t nat
+-A NETBIRD-RT-NAT -m mark --mark 0x1bd21 ! -o lo -j MASQUERADE --wait]:
+exit status 2: iptables v1.8.3 (legacy):
+Couldn't load match `mark':No such file or directory
+. Proceeding with userspace
+```
+
+NetBird keeps working after this. Filtering moves to the userspace packet filter, and on a routing peer the forwarding
+path moves to userspace as well, which is slower than letting the kernel forward. Appliance and NAS firmware is where
+this usually shows up.
+
+To get the kernel path back, start with the narrower options, because they keep NetBird in charge of filtering:
+
+- Load the missing module on the host if the firmware ships it, for example `xt_mark` for the `mark` match above.
+- `NB_SKIP_NFTABLES_CHECK` sends the client straight to the iptables backend, which helps when nftables is present but
+non-functional.
+- `NB_USE_LEGACY_ROUTING` falls back to the simpler routing method, which does not rely on `fwmark` or `ip rule`.
+
+Both variables are described in [Client Environment Variables](/client/environment-variables).
+
+If the host cannot support the client's rules and you would rather use the firewall tooling it does have, stop the
+client from managing rules at all:
+
+```shell
+netbird up --disable-firewall
+```
+
+<Warning>
+This flag is not the same as the automatic fallback above. With `--disable-firewall` the client does not manage host
+firewall rules and the userspace packet filter does not take over, so NetBird enforces no access control on this peer.
+The policies you configure in NetBird are not applied here, and any peer that can reach this one over the tunnel is
+unfiltered until you recreate those restrictions with the host's own firewall. Only use it where you will do that.
+</Warning>
+
+You then cover the two jobs the client was doing.
+
+1. Turn on forwarding, if this peer routes traffic for others:
+
+```shell
+sudo sysctl -w net.ipv4.ip_forward=1
+sudo sysctl -w net.ipv6.conf.all.forwarding=1
+```
+
+2. Replace the access control NetBird was enforcing with your own filtering rules for the NetBird interface (`wt0`),
+using whatever the host does provide, such as iptables, nftables, or the appliance's own firewall interface. Mirror the
+access you intended in your NetBird policies, and default to denying anything you have not explicitly allowed.
+
+To confirm the result, check forwarding with `sysctl net.ipv4.ip_forward`, then test the traffic you actually care about
+from another peer. A tunnel can come up and report healthy in `netbird status -d` while filtering or forwarding is still
+missing.
+
 ## Debugging GRPC
 
 The NetBird client communicates with the Management and Signal servers using the GRPC framework. With these parameters,