Document missing config items from v1.6.0, v1.10.0 & improve existing config items (#311)

Author: jasikpark

docs/config/listen.mdx

@@ -43,3 +43,40 @@ Configure socket buffers for the udp side (outside), leave unset to use the syst
 the kernel. Default is `net.core.rmem_default` and `net.core.wmem_default` (`/proc/sys/net/core/rmem_default` and
 `/proc/sys/net/core/rmem_default`). Maximum is limited by memory in the system, `SO_RCVBUFFORCE` and `SO_SNDBUFFORCE` is
 used to avoid having to raise the system wide max, `net.core.rmem_max` and `net.core.wmem_max`
+
+## listen.send_recv_error
+
+<Pill className="mb-24">Reloadable</Pill> <Pill className="mb-24">Default: `always`</Pill>
+<Pill className="mb-24">Added in v1.6.0</Pill>
+
+By default, Nebula replies to packets it has no tunnel for with a `recv_error` packet. This packet helps speed up
+reconnection in the case that Nebula on either side did not shut down cleanly. This response can be abused however as a
+way to discover if Nebula is running on a host. `send_recv_error` lets you configure if you want to send `recv_error`
+packets `always`, `never`, or only to `private` network remotes.
+
+Valid values: `always`, `never`, `private`
+
+## listen.so_mark
+
+<Pill className="mb-24">Added in v1.10.0</Pill>
+
+On Linux systems, Nebula can now mark packets using the
+[SO_MARK socket option](<https://www.man7.org/linux/man-pages/man7/socket.7.html#:~:text=SO_MARK%20(since%20Linux,Linux%205.17)%20capability.>)
+to enable advanced routing scenarios. This is particularly useful for full subnet routing (including `0.0.0.0/0`)
+without the complexity of network namespaces, allowing administrators to route Nebula traffic through custom routing
+tables.
+
+```yaml
+# Mark Nebula packets with firewall mark 4242
+listen:
+  so_mark: 4242
+```
+
+Example setup for `0.0.0.0/0` routing through Nebula:
+
+```console
+# Create routing rules to handle marked traffic
+ip rule add not from all fwmark 4242 lookup 4242
+ip rule add from all lookup main suppress_prefixlength 0
+ip route add default dev nebula1 via &lt;nebula_unsafe_route_gw&gt; table 4242
+```

docs/config/tun.mdx

@@ -62,12 +62,14 @@ Default is 500.
 
 Default MTU for every packet, safe setting is (and the default) 1300 for internet routed packets.
 
+See below for per-route overrides ([`tun.routes`](#tunroutes)).
+
 ## tun.routes
 
 <Pill className="mb-24">Reloadable</Pill>
 
 Route based MTU overrides. If you have known VPN IP paths that can support larger MTUs you can increase/decrease them
-here.
+here. This will override the default MTU ([`tun.mtu`](#tunmtu)) for Nebula packets on a per-route basis.
 
 ```yml
 tun:
@@ -102,6 +104,35 @@ tun:
 
 For more information, see the [Extend network access beyond overlay hosts](/docs/guides/unsafe_routes/) guide.
 
+### ECMP support for `unsafe_routes`
+
+<Pill className="mb-24">Added in v1.10.0</Pill>
+
+[Equal-Cost Multi-Path routing](https://en.wikipedia.org/wiki/Equal-cost_multi-path_routing) is now available for
+unsafe_routes, enabling load balancing and redundancy within a single host. You can now configure multiple gateways for
+the same route on one host, with optional weighting for unequal load distribution.
+
+```yaml
+unsafe_routes:
+  # Multiple gateways with equal weighting (default weight: 1)
+  - route: 192.168.100.0/24
+    via:
+      - gateway: 10.0.0.1
+      - gateway: 10.0.0.2
+
+  # Multiple gateways with custom weights
+  - route: 192.168.101.0/24
+    via:
+      - gateway: 10.0.0.1
+        weight: 10
+      - gateway: 10.0.0.2
+        weight: 5
+```
+
+The implementation uses [hash-threshold mapping](https://tools.ietf.org/html/rfc2992) (similar to the Linux kernel) to
+distribute traffic based on packet hashing. When a gateway becomes unreachable, traffic automatically fails over to the
+remaining available gateways, though load balancing may become uneven until the failed gateway recovers.
+
 ## tun.use_system_route_table
 
 <Pill className="mb-24">Default: False</Pill>