diff --git a/ops/nixos/kerrigan/default.nix b/ops/nixos/kerrigan/default.nix
index dd69f40602..811d069582 100644
--- a/ops/nixos/kerrigan/default.nix
+++ b/ops/nixos/kerrigan/default.nix
@@ -48,6 +48,13 @@ in
     interfaces.eth2.useDHCP = true;
     interfaces.enu1u4i10.useDHCP = true;
     firewall.interfaces.br0.allowedTCPPorts = [ 80 ];
+    nat = {
+      enable = true;
+      enableIPv6 = true;
+      internalInterfaces = [ "br0" ];
+      externalInterface = "enu1u4i10";
+      dmzHost = "10.42.0.2";
+    };
   };
   users.users.lukegb.extraGroups = lib.mkAfter [ "networkmanager" ];
   my.systemType = "aarch64-linux";