Add L3 forwarding support

docs/configuration/shared/pre-match.md

@@ -4,6 +4,10 @@ icon: material/new-box
 
 # Pre-match
 
+!!! quote "Changes in sing-box 1.14.0"
+
+    :material-alert: [route](#route)
+
 !!! quote "Changes in sing-box 1.13.0"
 
     :material-plus: [bypass](#bypass)
@@ -12,7 +16,7 @@ Pre-match is rule matching that runs before the connection is established.
 
 ### How it works
 
-When TUN receives a connection request, the connection has not yet been established,
+When an L3 inbound (TUN, WireGuard, or Tailscale) receives a connection request, the connection has not yet been established,
 so no connection data can be read. In this phase, sing-box runs the routing rules in pre-match mode.
 
 Since connection data is unavailable, only actions that do not require connection data can be executed.
@@ -28,7 +32,24 @@ See [reject](/configuration/route/rule_action/#reject) for details.
 
 #### route
 
-Route ICMP connections to the specified outbound for direct reply.
+!!! quote "Changes in sing-box 1.14.0"
+
+    Since sing-box 1.14.0, TCP and UDP connections can also be forwarded at L3;
+    previously only ICMP connections were supported.
+
+Forward connections directly at L3 to the specified outbound,
+without going through L3 to L4 translation.
+
+Supported targets:
+
+- ICMP connections: Direct outbounds and WireGuard / Tailscale endpoints.
+- TCP and UDP connections: WireGuard and Tailscale endpoints.
+
+L3 forwarding also applies when no rule matches and the default outbound is a supported
+target; for outbound groups, the currently selected outbound is used.
+
+FakeIP destinations require a `resolve` action performed in pre-match,
+otherwise connections will be rejected.
 
 See [route](/configuration/route/rule_action/#route) for details.
 

docs/configuration/shared/pre-match.zh.md

@@ -4,6 +4,10 @@ icon: material/new-box
 
 # 预匹配
 
+!!! quote "sing-box 1.14.0 中的更改"
+
+    :material-alert: [route](#route)
+
 !!! quote "sing-box 1.13.0 中的更改"
 
     :material-plus: [bypass](#bypass)
@@ -12,7 +16,7 @@ icon: material/new-box
 
 ### 工作原理
 
-当 TUN 收到连接请求时，连接尚未建立，因此无法读取连接数据。在此阶段，sing-box 在预匹配模式下运行路由规则。
+当 L3 入站（TUN、WireGuard 或 Tailscale）收到连接请求时，连接尚未建立，因此无法读取连接数据。在此阶段，sing-box 在预匹配模式下运行路由规则。
 
 由于连接数据不可用，只有不需要连接数据的动作才能执行。当规则匹配到需要已建立连接的动作时，预匹配将在该规则处停止。
 
@@ -26,7 +30,20 @@ icon: material/new-box
 
 #### route
 
-将 ICMP 连接路由到指定出站以直接回复。
+!!! quote "sing-box 1.14.0 中的更改"
+
+    自 sing-box 1.14.0 起，TCP 和 UDP 连接也可以在 L3 转发；此前仅支持 ICMP 连接。
+
+将连接直接在 L3 转发到指定出站，不经过 L3 到 L4 转换。
+
+支持的目标：
+
+- ICMP 连接：direct 出站和 WireGuard / Tailscale 端点。
+- TCP 和 UDP 连接：WireGuard 和 Tailscale 端点。
+
+当没有规则匹配且默认出站为受支持的目标时，L3 转发同样生效；对于出站组，使用当前选中的出站。
+
+FakeIP 目标需要在预匹配中先执行 `resolve` 动作，否则连接将被拒绝。
 
 详情参阅 [route](/zh/configuration/route/rule_action/#route)。