// Module included in the following assemblies:
//
// * networking/metallb/metallb-troubleshoot-support.adoc

:_mod-docs-content-type: CONCEPT
[id="nw-metallb-onv-k-gateway-modes_{context}"]
= OVN-Kubernetes gateway modes and when to switch

[role="_abstract"]
MetalLB compatibility with OVN-Kubernetes depends on the gateway mode configuration. This section explains the differences between shared and local gateway modes and provides guidance on when to switch.

A common troubleshooting point is the gateway mode. The requirement depends on your node configuration:

* **Single Interface**: MetalLB functions correctly in the default **Shared Gateway mode**.
* **Multiple Interfaces (Common in telco environment)**: MetalLB requires **Local Gateway mode** (`routingViaHost: true`). In Shared Gateway mode with multiple interfaces, traffic steering does not work correctly.

To check your current configuration, run the following command:
[source,bash]
----
$ oc get network.operator cluster -o jsonpath='{.spec.defaultNetwork.ovnKubernetesConfig.gatewayConfig.routingViaHost}'
----

If your environment uses multiple interfaces and returns `false`, patch to enable local gateway mode by running the following command:
[source,bash]
----
$ oc patch network.operator cluster --type=merge -p '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"gatewayConfig":{"routingViaHost": true}}}}}'
----
+
[NOTE]
====
Applying this patch causes the OVN-Kubernetes pods to restart. Nodes do not reboot.
====

In BGP mode with multiple interfaces, IPv4 forwarding must be enabled on the secondary interface that receives external traffic.
+
[NOTE]
====
This is only required for IPv4 traffic. IPv6 forwarding is always enabled.
====

The following describes the packet flow:

. External IPv4 traffic destined for the VIP assigned by MetalLB arrives on the secondary interface.
. The secondary interface must have IPv4 forwarding enabled for example, `net.ipv4.conf.eth2.forwarding=1` so that the packet enters Open vSwitch (OVS).
. OVN-Kubernetes has rules configured to deliver the packet to the endpoint pod.
. The pod sends its reply. Because `routingViaHost` is `true`, the return packets pass through the kernel networking stack.
. The return traffic is sent back through the secondary interface only if the routing table routes the client IP address (the `<source_ip>` from the original packet) to the correct interface. You can verify this by running `ip route get <source_ip>` and confirming that the output shows the secondary interface. For more information about configuring symmetric return traffic, see _Managing symmetric routing with MetalLB_.

Configure per-interface forwarding by using one of the following methods:

* For {product-title} 4.22 and later, use an NMState configuration to enable forwarding on the secondary interface. This is the recommended method.
* For versions earlier than {product-title} 4.22, use a `MachineConfig` object to enable forwarding on the secondary interface.
+
[NOTE]
====
Enabling global IPv4 forwarding (`net.ipv4.ip_forward=1`) resolves the forwarding requirement but is not recommended because it enables forwarding on all interfaces rather than only the secondary interface that receives external traffic. OVN-Kubernetes does not install default `DROP` firewall rules on interfaces.
====
