diff --git a/src/pages/manage/networks/use-cases/site-to-vpn.mdx b/src/pages/manage/networks/use-cases/site-to-vpn.mdx
index 948b08c6..4cbe75be 100644
--- a/src/pages/manage/networks/use-cases/site-to-vpn.mdx
+++ b/src/pages/manage/networks/use-cases/site-to-vpn.mdx
@@ -87,17 +87,13 @@ The routing peer must SNAT site traffic onto its NetBird interface so the
 overlay peer's access control sees a NetBird IP it recognises. See
 [Outbound SNAT requirement](#outbound-snat-requirement) for the reasoning.
 
-**On Linux:** NetBird installs the SNAT automatically when masquerade is
-enabled on the routing peer (Step 4). Just enable IP forwarding:
+**On Linux:** no manual SNAT configuration is needed. NetBird enables IP
+forwarding and installs the SNAT itself when masquerade is enabled on the
+routing peer (Step 4).
 
-```bash
-sudo sysctl -w net.ipv4.ip_forward=1
-echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-netbird-routing.conf
-```
-
-If you run a host firewall (UFW, firewalld) with the `FORWARD` chain default
-set to `DROP`, also allow forwarding between the site-facing interface and
-`wt0`:
+The only Linux-side caveat is if you run a host firewall (UFW, firewalld)
+with the `FORWARD` chain default set to `DROP` — in that case, allow
+forwarding between the site-facing interface and `wt0`:
 
 ```bash
 sudo iptables -I FORWARD 1 -i <site-iface> -o wt0 -j ACCEPT