diff --git a/bootstrap/tasks/validation/vars.yaml b/bootstrap/tasks/validation/vars.yaml
index 9fcfcf45..72730fbb 100644
--- a/bootstrap/tasks/validation/vars.yaml
+++ b/bootstrap/tasks/validation/vars.yaml
@@ -9,6 +9,7 @@
   loop:
     - bootstrap_acme_email
     - bootstrap_age_public_key
+    - bootstrap_cilium_loadbalancer_mode
     - bootstrap_cloudflare_account_tag
     - bootstrap_cloudflare_domain
     - bootstrap_cloudflare_token
diff --git a/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2 b/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2
index ec488a21..0c093fee 100644
--- a/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2
+++ b/bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2
@@ -53,7 +53,7 @@ spec:
       {% endif %}
     loadBalancer:
       algorithm: maglev
-      mode: dsr
+      mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
     localRedirectPolicy: true
     operator:
       replicas: 1
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2
index ba9fd9c3..32c70548 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmvalues.yaml.j2
@@ -79,7 +79,7 @@ data:
       {% endif %}
     loadBalancer:
       algorithm: maglev
-      mode: dsr
+      mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
     localRedirectPolicy: true
     operator:
       replicas: 1
diff --git a/bootstrap/vars/config.sample.yaml b/bootstrap/vars/config.sample.yaml
index 464efabe..0f848a68 100644
--- a/bootstrap/vars/config.sample.yaml
+++ b/bootstrap/vars/config.sample.yaml
@@ -47,6 +47,9 @@ bootstrap_external_ingress_addr:
 # The Load balancer IP for internal ingress, choose an available IP in your nodes network that is not being used
 bootstrap_internal_ingress_addr:
 
+# (Advanced) Cilium load balancer mode, choose either dsr or snat, if you nodes aren't on a network by themselves change this to snat
+bootstrap_cilium_loadbalancer_mode: dsr
+
 # Keep the next three options default unless you know what you are doing
 # (Advanced) Enable ipv6
 bootstrap_ipv6_enabled: false