diff --git a/src/pages/get-started/install/synology.mdx b/src/pages/get-started/install/synology.mdx
index 1a07b7ac..04d0593b 100644
--- a/src/pages/get-started/install/synology.mdx
+++ b/src/pages/get-started/install/synology.mdx
@@ -51,6 +51,13 @@ fi
 ```
 4. If you’d like to see the logs for this task, select the task you create and click on Settings. Check the box that says Save output results, select a save location, and click OK. Now, if you select the task and **Action > View Result**, you’ll see any error logs and status.
 
+<Note>
+    Synology devices do not always expose every kernel module NetBird uses. Alongside the `tun` module above, the
+    netfilter match modules behind the client's firewall rules can be missing, `mark` and `ipset` in particular. The
+    client then logs a `failed to create native firewall` warning and falls back to userspace filtering. See
+    [When the client cannot manage firewall rules](/help/troubleshooting-client#when-the-client-cannot-manage-firewall-rules).
+</Note>
+
 ## Running with a Setup Key
 In case you are activating a server peer, you can use a [setup key](/manage/peers/register-machines-using-setup-keys) as described in the steps below.
 > This is especially helpful when you are running multiple server instances with infrastructure-as-code tools like ansible and terraform.
diff --git a/src/pages/help/troubleshooting-client.mdx b/src/pages/help/troubleshooting-client.mdx
index 6d5de68b..dcc24315 100644
--- a/src/pages/help/troubleshooting-client.mdx
+++ b/src/pages/help/troubleshooting-client.mdx
@@ -493,6 +493,67 @@ sudo netbird service stop
 sudo bash -c 'NB_WG_KERNEL_DISABLED=true netbird up -F'  > /tmp/netbird.log
 ```
 
+## When the client cannot manage firewall rules
+
+On Linux the client installs its own `nftables` or `iptables` rules to filter traffic and, on a routing peer, to forward
+routed traffic. Some hosts are missing the netfilter modules those rules depend on, such as the `mark` match used for
+policy routing or `ipset` used to match sets of addresses. The client reports this and carries on without the native
+firewall:
+
+```
+WARN client/firewall/create_linux.go:55: failed to create native firewall:
+init firewall: router init: create containers: add static nat rules:
+add outbound masquerade rule: running [/sbin/iptables -t nat
+-A NETBIRD-RT-NAT -m mark --mark 0x1bd21 ! -o lo -j MASQUERADE --wait]:
+exit status 2: iptables v1.8.3 (legacy):
+Couldn't load match `mark':No such file or directory
+. Proceeding with userspace
+```
+
+NetBird keeps working after this. Filtering moves to the userspace packet filter, and on a routing peer the forwarding
+path moves to userspace as well, which is slower than letting the kernel forward. Appliance and NAS firmware is where
+this usually shows up.
+
+To get the kernel path back, start with the narrower options, because they keep NetBird in charge of filtering:
+
+- Load the missing module on the host if the firmware ships it, for example `xt_mark` for the `mark` match above.
+- `NB_SKIP_NFTABLES_CHECK` sends the client straight to the iptables backend, which helps when nftables is present but
+non-functional.
+- `NB_USE_LEGACY_ROUTING` falls back to the simpler routing method, which does not rely on `fwmark` or `ip rule`.
+
+Both variables are described in [Client Environment Variables](/client/environment-variables).
+
+If the host cannot support the client's rules and you would rather use the firewall tooling it does have, stop the
+client from managing rules at all:
+
+```shell
+netbird up --disable-firewall
+```
+
+<Warning>
+This flag is not the same as the automatic fallback above. With `--disable-firewall` the client does not manage host
+firewall rules and the userspace packet filter does not take over, so NetBird enforces no access control on this peer.
+The policies you configure in NetBird are not applied here, and any peer that can reach this one over the tunnel is
+unfiltered until you recreate those restrictions with the host's own firewall. Only use it where you will do that.
+</Warning>
+
+You then cover the two jobs the client was doing.
+
+1. Turn on forwarding, if this peer routes traffic for others:
+
+```shell
+sudo sysctl -w net.ipv4.ip_forward=1
+sudo sysctl -w net.ipv6.conf.all.forwarding=1
+```
+
+2. Replace the access control NetBird was enforcing with your own filtering rules for the NetBird interface (`wt0`),
+using whatever the host does provide, such as iptables, nftables, or the appliance's own firewall interface. Mirror the
+access you intended in your NetBird policies, and default to denying anything you have not explicitly allowed.
+
+To confirm the result, check forwarding with `sysctl net.ipv4.ip_forward`, then test the traffic you actually care about
+from another peer. A tunnel can come up and report healthy in `netbird status -d` while filtering or forwarding is still
+missing.
+
 ## Debugging GRPC
 
 The NetBird client communicates with the Management and Signal servers using the GRPC framework. With these parameters,