Update doc

README.md

@@ -42,12 +42,16 @@ Default settings are picked to suit general use cases and maximize compatibility
 * Upstream network interface: Main upstream used to reroute traffic. Leave blank for auto detect system VPN.
   Put `none` (or other similarly invalid entries) to suppress tethering VPN.
   Put your interface name for tethering WireGuard.
-* Fallback upstream: Fallback upstream is used when some VPN leave certain routes fallback to default network interface.
-  Leave blank for auto detect. Put `none` (or other similarly invalid entries) to forbid falling back.
-  Put other interface name if you feel like it.
-* IP Masquerade: Source address/port from downstream packets will be remapped. Leave on if you don't know what it does.
-  I find turning this option off sometimes works better for dummy VPNs like ad-blockers and socksifiers (like
-  Shadowsocks). But you should never turn it off for real VPNs like OpenVPN, WireGuard, etc.
+* IP Masquerade Mode:
+  - None:
+    Nothing will be done to remap address/port from downstream.
+    I find turning this option off sometimes works better for dummy VPNs like ad-blockers and socksifiers than Simple mode, e.g. Shadowsocks.
+    But you should never use this for real VPNs like OpenVPN, WireGuard, etc.
+  - Simple: Source address/port from downstream packets will be remapped and that's about it.
+  - Android Netd Service: (experimental since 2.2.0)
+    Let your system handle masquerade.
+    Android system will do a few extra things to make things like FTP and tethering traffic counter work.
+    You should probably not use this if you are trying to hide your tethering activity from your carrier.
 
 ### Downstream