diff --git a/ansible/environments/jail/host_vars/nat_dhcp b/ansible/environments/jail/host_vars/nat_dhcp
new file mode 100644
index 0000000..1d0b6d9
--- /dev/null
+++ b/ansible/environments/jail/host_vars/nat_dhcp
@@ -0,0 +1 @@
+os_flavor: "freebsd"
diff --git a/ansible/environments/jail/hosts b/ansible/environments/jail/hosts
new file mode 100644
index 0000000..af5f04e
--- /dev/null
+++ b/ansible/environments/jail/hosts
@@ -0,0 +1,2 @@
+[jail]
+nat_dhcp ansible_connection=jail
diff --git a/ansible/environments/laptop/host_vars/odofreebsd b/ansible/environments/laptop/host_vars/odofreebsd
index 613c1a0..90dafca 100644
--- a/ansible/environments/laptop/host_vars/odofreebsd
+++ b/ansible/environments/laptop/host_vars/odofreebsd
@@ -39,6 +39,11 @@ users:
 devfs_rules: "odo_devfs.rules"
 jail_zfs_dataset: zroot/freebsd/release/jails
 jail_zfs_dataset_mountpoint: /jail/main
+jail_list:
+  - name: nat_dhcp
+    enabled: true
+    conf:
+      src: nat_dhcp
 bhyve_dataset: zroot/freebsd/release/vm
 bhyve_list: []
 efi_dev: /dev/gpt/EFI
diff --git a/ansible/playbook.yaml b/ansible/playbook.yaml
index 2fb843d..623a887 100644
--- a/ansible/playbook.yaml
+++ b/ansible/playbook.yaml
@@ -1,4 +1,4 @@
-- hosts: all
+- hosts: all:!jail
   vars:
     ansible_become: True
   roles:
@@ -32,3 +32,9 @@
     - media
     - kubernetes
     - google_cloud_sdk
+
+- hosts: nat_dhcp
+  vars:
+    ansible_become: True
+  roles:
+    - jail_nat_dhcp
diff --git a/ansible/roles/blank/tasks/common.yaml b/ansible/roles/blank/tasks/common.yaml
index d7c1735..fef1101 100644
--- a/ansible/roles/blank/tasks/common.yaml
+++ b/ansible/roles/blank/tasks/common.yaml
@@ -9,6 +9,7 @@
     apply:
       become: yes
       become_user: "{{ initialize_user }}"
+  when: users is defined
   loop: "{{ users | dict2items | community.general.json_query('[?value.initialize==`true`].key') }}"
   loop_control:
     loop_var: initialize_user
diff --git a/ansible/roles/devfs/files/odo_devfs.rules b/ansible/roles/devfs/files/odo_devfs.rules
index d351b5b..b6ed32d 100644
--- a/ansible/roles/devfs/files/odo_devfs.rules
+++ b/ansible/roles/devfs/files/odo_devfs.rules
@@ -11,3 +11,9 @@ add path pf unhide
 add path pflog unhide
 add path pfsynv unhide
 add path 'tun*' unhide
+
+[tajaildhcp=14]
+add include $devfsrules_hide_all
+add include $devfsrules_unhide_basic
+add include $devfsrules_unhide_login
+add path 'bpf*' unhide
diff --git a/ansible/roles/jail/files/jails/nat_dhcp.conf b/ansible/roles/jail/files/jails/nat_dhcp.conf
new file mode 100644
index 0000000..c4f1ba6
--- /dev/null
+++ b/ansible/roles/jail/files/jails/nat_dhcp.conf
@@ -0,0 +1,11 @@
+nat_dhcp {
+    path = "/jail/main/jails/nat_dhcp";
+    vnet;
+    vnet.interface += "host_link3";
+    devfs_ruleset = 14;
+    mount.devfs; # To expose tun device
+
+    exec.start += "/bin/sh /etc/rc";
+    exec.stop = "/bin/sh /etc/rc.shutdown jail";
+    exec.consolelog = "/var/log/jail_${name}_console.log";
+}
diff --git a/ansible/roles/jail_nat_dhcp/files/dhcpd.conf b/ansible/roles/jail_nat_dhcp/files/dhcpd.conf
new file mode 100644
index 0000000..36d1f19
--- /dev/null
+++ b/ansible/roles/jail_nat_dhcp/files/dhcpd.conf
@@ -0,0 +1,12 @@
+# option definitions common to all supported networks...
+option domain-name "home.arpa";
+# option domain-name-servers ns1.home.arpa;
+option subnet-mask 255.255.255.0;
+default-lease-time 600;
+max-lease-time 7200;
+
+subnet 10.213.177.0 netmask 255.255.255.0 {
+  range 10.213.177.10 10.213.177.250;
+  option broadcast-address 10.213.177.255;
+  option routers 10.213.177.1;
+}
diff --git a/ansible/roles/jail_nat_dhcp/files/rc.conf b/ansible/roles/jail_nat_dhcp/files/rc.conf
new file mode 100644
index 0000000..cfa78b1
--- /dev/null
+++ b/ansible/roles/jail_nat_dhcp/files/rc.conf
@@ -0,0 +1,3 @@
+ifconfig_host_link3="inet 10.213.177.254 netmask 255.255.255.0"
+defaultrouter="10.213.177.1"
+dhcpd_enable="YES"
diff --git a/ansible/roles/jail_nat_dhcp/files/resolv.conf b/ansible/roles/jail_nat_dhcp/files/resolv.conf
new file mode 100644
index 0000000..582d17e
--- /dev/null
+++ b/ansible/roles/jail_nat_dhcp/files/resolv.conf
@@ -0,0 +1,2 @@
+search home.arpa
+nameserver 10.213.177.1
diff --git a/ansible/roles/jail_nat_dhcp/tasks/common.yaml b/ansible/roles/jail_nat_dhcp/tasks/common.yaml
new file mode 100644
index 0000000..fef1101
--- /dev/null
+++ b/ansible/roles/jail_nat_dhcp/tasks/common.yaml
@@ -0,0 +1,15 @@
+- import_tasks: tasks/freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/linux.yaml
+  when: 'os_flavor == "linux"'
+
+- include_tasks:
+    file: tasks/peruser.yaml
+    apply:
+      become: yes
+      become_user: "{{ initialize_user }}"
+  when: users is defined
+  loop: "{{ users | dict2items | community.general.json_query('[?value.initialize==`true`].key') }}"
+  loop_control:
+    loop_var: initialize_user
diff --git a/ansible/roles/jail_nat_dhcp/tasks/freebsd.yaml b/ansible/roles/jail_nat_dhcp/tasks/freebsd.yaml
new file mode 100644
index 0000000..b98022f
--- /dev/null
+++ b/ansible/roles/jail_nat_dhcp/tasks/freebsd.yaml
@@ -0,0 +1,20 @@
+- name: Install packages
+  package:
+    name:
+      - dhcpd
+    state: present
+
+- name: Install Configuration
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: 0644
+    owner: root
+    group: wheel
+  loop:
+    - src: rc.conf
+      dest: /etc/rc.conf
+    - src: dhcpd.conf
+      dest: /usr/local/etc/dhcpd.conf
+    - src: resolv.conf
+      dest: /etc/resolv.conf
diff --git a/ansible/roles/jail_nat_dhcp/tasks/linux.yaml b/ansible/roles/jail_nat_dhcp/tasks/linux.yaml
new file mode 100644
index 0000000..429ad91
--- /dev/null
+++ b/ansible/roles/jail_nat_dhcp/tasks/linux.yaml
@@ -0,0 +1,21 @@
+# - name: Build aur packages
+#   register: buildaur
+#   become_user: "{{ build_user.name }}"
+#   command: "aurutils-sync --no-view {{ item }}"
+#   args:
+#     creates: "/var/cache/pacman/custom/{{ item }}-*.pkg.tar.*"
+#   loop:
+#     - foo
+
+# - name: Update cache
+#   when: buildaur.changed
+#   pacman:
+#     name: []
+#     state: present
+#     update_cache: true
+    
+# - name: Install packages
+#   package:
+#     name:
+#       - foo
+#     state: present
diff --git a/ansible/roles/jail_nat_dhcp/tasks/main.yaml b/ansible/roles/jail_nat_dhcp/tasks/main.yaml
new file mode 100644
index 0000000..6805b9d
--- /dev/null
+++ b/ansible/roles/jail_nat_dhcp/tasks/main.yaml
@@ -0,0 +1,2 @@
+- import_tasks: tasks/common.yaml
+  # when: foo is defined
diff --git a/ansible/roles/jail_nat_dhcp/tasks/peruser.yaml b/ansible/roles/jail_nat_dhcp/tasks/peruser.yaml
new file mode 100644
index 0000000..111e886
--- /dev/null
+++ b/ansible/roles/jail_nat_dhcp/tasks/peruser.yaml
@@ -0,0 +1,29 @@
+- include_role:
+    name: per_user
+
+# - name: Create directories
+#   file:
+#     name: "{{ account_homedir.stdout }}/{{ item }}"
+#     state: directory
+#     mode: 0700
+#     owner: "{{ account_name.stdout }}"
+#     group: "{{ group_name.stdout }}"
+#   loop:
+#     - ".config/foo"
+
+# - name: Copy files
+#   copy:
+#     src: "files/{{ item.src }}"
+#     dest: "{{ account_homedir.stdout }}/{{ item.dest }}"
+#     mode: 0600
+#     owner: "{{ account_name.stdout }}"
+#     group: "{{ group_name.stdout }}"
+#   loop:
+#     - src: foo.conf
+#       dest: .config/foo/foo.conf
+
+- import_tasks: tasks/peruser_freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/peruser_linux.yaml
+  when: 'os_flavor == "linux"'
diff --git a/ansible/roles/jail_nat_dhcp/tasks/peruser_freebsd.yaml b/ansible/roles/jail_nat_dhcp/tasks/peruser_freebsd.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/ansible/roles/jail_nat_dhcp/tasks/peruser_linux.yaml b/ansible/roles/jail_nat_dhcp/tasks/peruser_linux.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/ansible/run.bash b/ansible/run.bash
index 39403f3..8e33196 100755
--- a/ansible/run.bash
+++ b/ansible/run.bash
@@ -22,6 +22,8 @@ elif [ "$target" = "odolinux" ]; then
     ansible-playbook -v -i environments/laptop playbook.yaml --diff --limit odolinux "${@}"
 elif [ "$target" = "odofreebsd" ]; then
     ansible-playbook -v -i environments/laptop playbook.yaml --diff --limit odofreebsd "${@}"
+elif [ "$target" = "jail_nat_dhcp" ]; then
+    ansible-playbook -v -i environments/jail playbook.yaml --diff --limit nat_dhcp "${@}"
 else
     die 1 "Unrecognized target"
 fi