doc: updated for nft/iptables dependencies

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

README.md

@@ -66,6 +66,15 @@ yum install -y rubygem-ronn-ng
 See [README-radius](doc/README-radius.md) for more information on Radius
 dependencies and its configuration.
 
+# Runtime dependencies
+
+When the `restrict-user-to-routes` or `restrict-user-to-ports` options are
+configured, ocserv invokes `/usr/libexec/ocserv-fw` at runtime to enforce
+firewall rules. That script requires either `nft` (nftables) or `iptables`
+depending on the backend selected with the `-Dfirewall-script=` meson option
+at build time. The default is `nftables` when `nft` is present at configure
+time, otherwise `iptables`.
+
 # Build instructions
 
 ```

doc/sample.config

@@ -688,10 +688,13 @@ no-route = 192.168.5.0/255.255.255.0
 #no-udp = false
 
 # If set, the script /usr/libexec/ocserv-fw will be called to restrict
-# the user to its allowed routes and prevent him from accessing
+# the user to its allowed routes and prevent them from accessing
 # any other routes. In case of defaultroute, the no-routes are restricted.
 # All the routes applied by ocserv can be reverted using /usr/libexec/ocserv-fw
 # --removeall. This option can be set globally or in the per-user configuration.
+#
+# Note: the ocserv-fw script requires either nft (nftables) or iptables at runtime,
+# depending on the backend selected with -Dfirewall-script= at build time.
 # [scope: vhost user]
 #restrict-user-to-routes = true