diff --git a/peering.nix b/peering.nix
index 9832e4f..bc5ed97 100644
--- a/peering.nix
+++ b/peering.nix
@@ -62,6 +62,12 @@ in
     ];
 
     networking = {
+      nat = mkIf host.isRouter {
+        enable = true;
+        enableIPv6 = true;
+        internalInterfaces = [ "birdsong" ];
+      };
+
       firewall.allowedUDPPorts = mkIf cfg.openPorts [ host.port ];
 
       wireguard.interfaces.${cfg.interface} = {