X-Git-Url: https://www.tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=doc%2Ftinc.texi;h=091b5e7a0e50f3692722b6f92f39b5d9c32e6e05;hp=5d0bf31fb42939e2b99f44965046f065d88cc8eb;hb=95a6974de173e0cb78611c6704ed09631d510dae;hpb=5038964032ef55913b2d4741c67bf191b2208abb

diff --git a/doc/tinc.texi b/doc/tinc.texi
index 5d0bf31f..091b5e7a 100644
--- a/doc/tinc.texi
+++ b/doc/tinc.texi
@@ -818,6 +818,26 @@ Tinc will expect packets read from the virtual network device
 to start with an Ethernet header.
 @end table
 
+@cindex Forwarding
+@item Forwarding = <off|internal|kernel> (internal)
+This option selects the way indirect packets are forwarded.
+
+@table @asis
+@item off
+Incoming packets that are not meant for the local node,
+but which should be forwarded to another node, are dropped.
+
+@item internal
+Incoming packets that are meant for another node are forwarded by tinc internally.
+
+This is the default mode, and unless you really know you need another forwarding mode, don't change it.
+
+@item kernel
+Incoming packets are always sent to the TUN/TAP device, even if the packets are not for the local node.
+This is less efficient, but allows the kernel to apply its routing and firewall rules on them,
+and can also help debugging.
+@end table
+
 @cindex GraphDumpFile
 @item GraphDumpFile = <@var{filename}> [experimental]
 If this option is present,