add note on firewall being experimental and how to opt a single client

out of the firewall.

docs/content/guides/admin.md

@@ -10,6 +10,12 @@ Enable server-side firewall filtering to enforce network access restrictions per
 
 When enabled, each client can have custom "Firewall Allowed IPs" configured that restrict which destinations they can access through the VPN. These restrictions are enforced by the server using iptables/ip6tables and cannot be bypassed by the client.
 
+/// warning | Experimental Feature
+
+This feature is currently experimental. While functional, it should be thoroughly tested in your environment before relying on it for production security requirements. Always verify that firewall rules are working as expected using test traffic or by manually inspecting the rules.
+
+///
+
 **Requirements:**
 
 - `iptables` must be installed on the host system

docs/content/guides/clients.md

@@ -59,7 +59,9 @@ Protocol specifiers (`/tcp` or `/udp`) require a port number. The following form
 
 - **Empty**: Falls back to the client's "Allowed IPs" setting
 - **Specified**: Only listed destinations are accessible (allow-only, everything else is blocked)
-- **Use Case Examples**:
+- **Disable for specific client**: To disable firewall filtering for a single client while keeping it enabled for others, add `0.0.0.0/0, ::/0` to allow all traffic
+
+**Use Case Examples**:
     - Allow only specific servers: `10.10.0.5`
     - Allow only internal network: `10.10.0.0/24, 192.168.1.0/24`
     - Allow only web browsing: `0.0.0.0/0:80, 0.0.0.0/0:443, ::/0:80, ::/0:443`