From 85266d83a9722da385c6ea9cb7115f9f7ab38bf8 Mon Sep 17 00:00:00 2001
From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
Date: Wed, 13 May 2026 12:43:25 +0200
Subject: [PATCH] docs(site-to-vpn): drop sysctl ip_forward instruction on
 Linux

NetBird handles IP forwarding itself on Linux; the manual sysctl was
unnecessary noise. Keep the host-firewall FORWARD-ACCEPT note since
UFW/firewalld setups still need it.
---
 .../manage/networks/use-cases/site-to-vpn.mdx    | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/src/pages/manage/networks/use-cases/site-to-vpn.mdx b/src/pages/manage/networks/use-cases/site-to-vpn.mdx
index 948b08c6..4cbe75be 100644
--- a/src/pages/manage/networks/use-cases/site-to-vpn.mdx
+++ b/src/pages/manage/networks/use-cases/site-to-vpn.mdx
@@ -87,17 +87,13 @@ The routing peer must SNAT site traffic onto its NetBird interface so the
 overlay peer's access control sees a NetBird IP it recognises. See
 [Outbound SNAT requirement](#outbound-snat-requirement) for the reasoning.
 
-**On Linux:** NetBird installs the SNAT automatically when masquerade is
-enabled on the routing peer (Step 4). Just enable IP forwarding:
+**On Linux:** no manual SNAT configuration is needed. NetBird enables IP
+forwarding and installs the SNAT itself when masquerade is enabled on the
+routing peer (Step 4).
 
-```bash
-sudo sysctl -w net.ipv4.ip_forward=1
-echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-netbird-routing.conf
-```
-
-If you run a host firewall (UFW, firewalld) with the `FORWARD` chain default
-set to `DROP`, also allow forwarding between the site-facing interface and
-`wt0`:
+The only Linux-side caveat is if you run a host firewall (UFW, firewalld)
+with the `FORWARD` chain default set to `DROP` — in that case, allow
+forwarding between the site-facing interface and `wt0`:
 
 ```bash
 sudo iptables -I FORWARD 1 -i <site-iface> -o wt0 -j ACCEPT