doc: statements: fwd supports for sending packets via neighbouring layer

Document ability to forward packets through neighbour layer added in
30d45266bf38 ("expr: extend fwd statement to support address and family").

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/doc/statements.txt b/doc/statements.txt
index 8076c21cded41bc4905b11961e9ff753fd93fc8f..bda63bb3bc38eb2db5bf081b662540a765b6d43c 100644 (file)
--- a/doc/statements.txt
+++ b/doc/statements.txt
@@ -683,7 +683,24 @@ The fwd statement is used to redirect a raw packet to another interface. It is
 only available in the netdev family ingress and egress hooks. It is similar to
 the dup statement except that no copy is made.
 
+You can also specify the address of the next hop and the device to forward the
+packet to. This updates the source and destination MAC address of the packet by
+transmitting it through the neighboring layer. This also decrements the ttl
+field of the IP packet. This provides a way to effectively bypass the classical
+forwarding path, thus skipping the fib (forwarding information base) lookup.
+
+[verse]
 *fwd to* 'device'
+*fwd* [*ip* | *ip6*] *to* 'address' *device* 'device'
+
+.Using the fwd statement
+------------------------
+# redirect raw packet to device
+netdev ingress fwd to "eth0"
+
+# forward packet to next hop 192.168.200.1 via eth0 device
+netdev ingress ether saddr set fwd ip to 192.168.200.1 device "eth0"
+-----------------------------------
 
 SET STATEMENT
 ~~~~~~~~~~~~~