diff --git a/resources/chaosknoten/router/nftables/nftables.conf b/resources/chaosknoten/router/nftables/nftables.conf
index 6d04a4c..3375bfb 100644
--- a/resources/chaosknoten/router/nftables/nftables.conf
+++ b/resources/chaosknoten/router/nftables/nftables.conf
@@ -45,7 +45,7 @@ table inet host {
         tcp dport 22 accept comment "allow ssh access"
 
         # Allow DHCP server access.
-		iifname $if_net0_3_ci_runner udp dport 67 accept comment "allow dhcp server access"
+		iifname { $if_net0_2_v4_nat, $if_net0_3_ci_runner } udp dport 67 accept comment "allow dhcp server access"
     }
 }
 
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
index c7fd9a7..b15259d 100644
--- a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
@@ -11,6 +11,12 @@ Description=v4-NAT
 # Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
 
+DHCPServer=true
+
+[DHCPServer]
+PoolOffset=100
+PoolSize=150
+
 [Address]
 Address=10.32.2.1/24