diff --git a/modules/nixos/microvm/networking.nix b/modules/nixos/microvm/networking.nix
index f347e7e..c455a58 100644
--- a/modules/nixos/microvm/networking.nix
+++ b/modules/nixos/microvm/networking.nix
@@ -12,7 +12,10 @@
           matchConfig.Name = bridge;
           dns = [ "${config.local.prefix}::1" ];
           domains = [ "~${config.networking.fqdn}" ];
-          addresses = [ { Address = "${config.local.prefix}::1/64"; } ];
+          addresses = [
+            { Address = "10.0.0.1/24"; }
+            { Address = "${config.local.prefix}::1/64"; }
+          ];
           ipv6Prefixes = [ { Prefix = "${config.local.prefix}::/64"; } ];
         };
 
@@ -31,13 +34,24 @@
           domain = config.networking.fqdn;
           local = "/${config.networking.fqdn}/";
           enable-ra = true;
-          dhcp-range = "::2,::ff,constructor:${bridge}";
+          dhcp-range = [
+            "10.0.0.2,10.0.0.255"
+            "::2,::ff,constructor:${bridge}"
+          ];
         };
 
         networking.firewall.allowedUDPPorts = [
           53
+          67
           547
         ];
+
+        networking.nat = {
+          enable = true;
+          enableIPv6 = true;
+          externalInterface = config.local.ethernetInterface;
+          internalInterfaces = [ bridge ];
+        };
       };
     };
 }
diff --git a/modules/services/tangled.nix b/modules/services/tangled.nix
index 589b951..9eb1888 100644
--- a/modules/services/tangled.nix
+++ b/modules/services/tangled.nix
@@ -40,8 +40,7 @@ in
       networking.firewall.allowedTCPPorts = [ 5555 ];
 
       services.tangled.knot = {
-        # TODO needs internet in VM
-        enable = false;
+        enable = true;
         server = {
           owner = "did:plc:l7ruokyumokt2tduqqvu33j6";
           hostname = external;