diff --git a/doc/statements.txt b/doc/statements.txt index 5becf0cbdbcf..3c5059ead608 100644 --- a/doc/statements.txt +++ b/doc/statements.txt @@ -604,6 +604,11 @@ table inet x { } ------------------------------------- +Note that the tproxy statement is non-terminal to allow post-processing of +packets, such as updating the packet marking. This is a change in behavior +compared to the legacy iptables TPROXY target which is terminal. To terminate +the packet processing after the tproxy statement, remember to issue a verdict. + SYNPROXY STATEMENT ~~~~~~~~~~~~~~~~~~ This statement will process TCP three-way-handshake parallel in netfilter