diff --git a/src/connectivity/management/network_manager/core/BUILD.gn b/src/connectivity/management/network_manager/core/BUILD.gn
index 3dea146..7c7be9f 100644
--- a/src/connectivity/management/network_manager/core/BUILD.gn
+++ b/src/connectivity/management/network_manager/core/BUILD.gn
@@ -11,9 +11,12 @@
   with_unit_tests = true
 
   deps = [
+    "//garnet/lib/rust/fidl_fuchsia_net_stack_ext",
+    "//garnet/public/lib/fidl/rust/fidl",
     "//garnet/public/rust/fuchsia-async",
     "//garnet/public/rust/fuchsia-component",
     "//garnet/public/rust/fuchsia-syslog",
+    "//sdk/fidl/fuchsia.net.dhcp:fuchsia.net.dhcp-rustc",
     "//sdk/fidl/fuchsia.net.filter:fuchsia.net.filter-rustc",
     "//sdk/fidl/fuchsia.netstack:fuchsia.netstack-rustc",
     "//sdk/fidl/fuchsia.router.config:fuchsia.router.config-rustc",
diff --git a/src/connectivity/management/network_manager/core/src/error.rs b/src/connectivity/management/network_manager/core/src/error.rs
index 2a09f50..5039d3e 100644
--- a/src/connectivity/management/network_manager/core/src/error.rs
+++ b/src/connectivity/management/network_manager/core/src/error.rs
@@ -4,7 +4,8 @@
 
 //! Custom error types for the network manager.
 
-use failure::Fail;
+use core::fmt::{self, Display};
+use failure::{Context, Fail};
 
 pub type Result<T> = std::result::Result<T, NetworkManager>;
 
@@ -23,6 +24,9 @@
     /// Errors related to HAL layer.
     #[fail(display = "{}", _0)]
     HAL(#[cause] Hal),
+    /// Errors with a detail string attached.
+    #[fail(display = "An error occurred.")]
+    INTERNAL(ErrorWithDetail),
     // Add error types here.
 }
 
@@ -41,6 +45,23 @@
         NetworkManager::HAL(e)
     }
 }
+impl From<Context<&'static str>> for NetworkManager {
+    fn from(inner: Context<&'static str>) -> Self {
+        NetworkManager::INTERNAL(ErrorWithDetail { inner: Context::new(inner.to_string()) })
+    }
+}
+
+#[derive(Fail, Debug)]
+pub struct ErrorWithDetail {
+    #[cause]
+    inner: Context<String>,
+}
+
+impl Display for ErrorWithDetail {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        Display::fmt(&self.inner, f)
+    }
+}
 
 /// Error type for packet LIFManager.
 #[derive(Fail, Debug, PartialEq)]
@@ -79,6 +100,12 @@
     NotEnabled,
     #[fail(display = "Could not disable service")]
     NotDisabled,
+    #[fail(display = "Failed to add new packet filter rules")]
+    ErrorAddingPacketFilterRules,
+    #[fail(display = "Failed to get packet filter rules")]
+    ErrorGettingPacketFilterRules,
+    #[fail(display = "Failed to enable NAT")]
+    ErrorFailedEnableNat,
     #[fail(display = "Service is not supported")]
     NotSupported,
 }
diff --git a/src/connectivity/management/network_manager/core/src/hal.rs b/src/connectivity/management/network_manager/core/src/hal.rs
index 4e840f11..04fc010 100644
--- a/src/connectivity/management/network_manager/core/src/hal.rs
+++ b/src/connectivity/management/network_manager/core/src/hal.rs
@@ -9,6 +9,7 @@
 use failure::{Error, ResultExt};
 use fidl_fuchsia_net;
 use fidl_fuchsia_net_stack::{InterfaceInfo, StackMarker, StackProxy};
+use fidl_fuchsia_net_stack_ext::FidlReturn;
 use fidl_fuchsia_netstack::{NetstackMarker, NetstackProxy};
 use fuchsia_component::client::connect_to_service;
 use std::collections::HashSet;
@@ -159,7 +160,7 @@
 
     pub async fn get_interface(&mut self, port: u64) -> Option<Interface> {
         match self.stack.get_interface_info(port).await {
-            Ok((Some(info), _)) => Some((&(*info)).into()),
+            Ok(Ok(info)) => Some((&info).into()),
             _ => None,
         }
     }
@@ -222,16 +223,9 @@
                 &mut addr.to_fidl_interface_address(),
             )
             .await;
-        match r {
-            Err(_) => Err(error::NetworkManager::HAL(error::Hal::OperationFailed)),
-            Ok(r) => match r {
-                None => Ok(()),
-                Some(e) => {
-                    println!("could not set interface address: ${:?}", e);
-                    Err(error::NetworkManager::HAL(error::Hal::OperationFailed))
-                }
-            },
-        }
+        r.squash_result()
+            .map_err(|_| error::NetworkManager::HAL(error::Hal::OperationFailed))
+            .map(|_| ())
     }
 
     /// `unset_ip_address` removes an IP address from the interface configuration.
@@ -273,14 +267,24 @@
     }
 
     pub async fn set_dhcp_client_state(&mut self, pid: PortId, enable: bool) -> error::Result<()> {
-        let r = self.netstack.set_dhcp_client_status(StackPortId::from(pid).to_u32(), enable).await;
-        match r {
-            Ok(fidl_fuchsia_netstack::NetErr {
-                status: fidl_fuchsia_netstack::Status::Ok,
-                message: _,
-            }) => Ok(()),
-            _ => Err(error::NetworkManager::HAL(error::Hal::OperationFailed)),
+        let (dhcp_client, server_end) =
+            fidl::endpoints::create_proxy::<fidl_fuchsia_net_dhcp::ClientMarker>()
+                .context("dhcp client: failed to create fidl endpoints")?;
+        if let Err(e) = self.netstack.get_dhcp_client(pid.to_u32(), server_end).await {
+            warn!("failed to create fidl endpoint for dhch client: {:?}", e);
+            return Err(error::NetworkManager::HAL(error::Hal::OperationFailed));
         }
+        let r = if enable {
+            dhcp_client.start().await.context("failed to start dhcp client")?
+        } else {
+            dhcp_client.stop().await.context("failed to stop dhcp client")?
+        };
+        if let Err(e) = r {
+            warn!("failed to start dhcp client: {:?}", e);
+            return Err(error::NetworkManager::HAL(error::Hal::OperationFailed));
+        }
+        info!("DHCP client on nicid: {}, enabled: {}", pid.to_u32(), enable);
+        Ok(())
     }
 
     // apply_manual_address updates the configured IP address.
diff --git a/src/connectivity/management/network_manager/core/src/lib.rs b/src/connectivity/management/network_manager/core/src/lib.rs
index 927a6e7..5ed7d4f 100644
--- a/src/connectivity/management/network_manager/core/src/lib.rs
+++ b/src/connectivity/management/network_manager/core/src/lib.rs
@@ -32,18 +32,20 @@
     port_manager: portmgr::PortManager,
     lif_manager: lifmgr::LIFManager,
     service_manager: servicemgr::Manager,
+    packet_filter: packet_filter::PacketFilter,
     hal: hal::NetCfg,
 }
 
 impl DeviceState {
     //! Create an empty DeviceState.
-    pub fn new(hal: hal::NetCfg) -> Self {
+    pub fn new(hal: hal::NetCfg, packet_filter: packet_filter::PacketFilter) -> Self {
         let v = 0;
         DeviceState {
             version: v,
             port_manager: portmgr::PortManager::new(),
             lif_manager: lifmgr::LIFManager::new(),
             service_manager: servicemgr::Manager::new(),
+            packet_filter: packet_filter,
             hal,
         }
     }
@@ -285,6 +287,7 @@
                         address: Some(address),
                         prefix_length: Some(prefix_length),
                     }) => {
+                        // The WAN IPv4 address is changing.
                         if lp.dhcp {
                             warn!(
                                 "Setting a static ip is not allowed when \
@@ -293,8 +296,9 @@
                             return Err(error::NetworkManager::LIF(error::Lif::NotSupported));
                         }
                         info!("setting ip to {:?} {:?}", address, prefix_length);
-                        let a = LifIpAddr::from(p.address_v4.as_ref().unwrap());
-                        lp.address = Some(a);
+                        let v4addr = LifIpAddr::from(p.address_v4.as_ref().unwrap());
+                        self.service_manager.set_global_ip_nat(v4addr.clone(), lif.pid());
+                        lp.address = Some(v4addr);
                     }
                     _ => {
                         warn!("invalid address {:?}", p.address_v4);
@@ -321,6 +325,7 @@
                         address: Some(address),
                         prefix_length: Some(prefix_length),
                     }) => {
+                        // WAN IPv6 address is changing.
                         if lp.dhcp {
                             warn!(
                                 "Setting a static ip is not allowed when \
@@ -376,9 +381,11 @@
                         address: Some(address),
                         prefix_length: Some(prefix_length),
                     }) => {
+                        // LAN IPv4 address is changing.
                         info!("setting ip to {:?} {:?}", address, prefix_length);
-                        let a = LifIpAddr::from(p.address_v4.as_ref().unwrap());
-                        lp.address = Some(a);
+                        let v4addr = LifIpAddr::from(p.address_v4.as_ref().unwrap());
+                        self.service_manager.set_local_subnet_nat(v4addr.clone());
+                        lp.address = Some(v4addr);
                     }
                     _ => {
                         warn!("invalid address {:?}", p.address_v4);
@@ -391,6 +398,7 @@
                         address: Some(address),
                         prefix_length: Some(prefix_length),
                     }) => {
+                        // LAN IPv6 address is changing.
                         info!("setting ip to {:?} {:?}", address, prefix_length);
                         let a = LifIpAddr::from(p.address_v6.as_ref().unwrap());
                         lp.address = Some(a);
@@ -407,8 +415,19 @@
                         lp.enabled = *enable
                     }
                 };
+
                 self.hal.apply_properties(lif.pid(), &old, &lp).await?;
                 lif.set_properties(self.version, lp)?;
+                if self.service_manager.is_nat_enabled() {
+                    if let Err(e) =
+                        self.packet_filter.update_nat(self.service_manager.get_nat_config()).await
+                    {
+                        warn!("Failed to enable nat: {:?}", e);
+                        return Err(error::NetworkManager::SERVICE(
+                            error::Service::ErrorFailedEnableNat,
+                        ));
+                    }
+                }
                 self.version += 1;
                 Ok(())
             }
@@ -434,6 +453,28 @@
     pub fn version(&self) -> Version {
         self.version
     }
+
+    /// `set_filter` installs a new packet filter rule.
+    pub async fn set_filter(
+        &self,
+        rule: fidl_fuchsia_router_config::FilterRule,
+    ) -> error::Result<()> {
+        match self.packet_filter.set_filter(rule).await {
+            Ok(_) => Ok(()),
+            Err(e) => {
+                warn!("Failed to set new filter rules: {:?}", e);
+                Err(error::NetworkManager::SERVICE(error::Service::ErrorAddingPacketFilterRules))
+            }
+        }
+    }
+
+    /// `get_filters` returns the currently installed packet filter rules.
+    pub async fn get_filters(&self) -> error::Result<Vec<fidl_fuchsia_router_config::FilterRule>> {
+        self.packet_filter.get_filters().await.map_err(|e| {
+            warn!("Failed to get filter rules: {:?}", e);
+            error::NetworkManager::SERVICE(error::Service::ErrorGettingPacketFilterRules)
+        })
+    }
 }
 
 type Version = u64;
@@ -473,7 +514,10 @@
 
     #[fasync::run_singlethreaded(test)]
     async fn test_new_device_state() {
-        let d = DeviceState::new(hal::NetCfg::new().unwrap());
+        let d = DeviceState::new(
+            hal::NetCfg::new().unwrap(),
+            packet_filter::PacketFilter::start().unwrap(),
+        );
 
         assert_eq!(d.version, 0);
         assert_eq!(d.port_manager.ports().count(), 0);
diff --git a/src/connectivity/management/network_manager/core/src/lifmgr.rs b/src/connectivity/management/network_manager/core/src/lifmgr.rs
index 1cb86df..f80d508 100644
--- a/src/connectivity/management/network_manager/core/src/lifmgr.rs
+++ b/src/connectivity/management/network_manager/core/src/lifmgr.rs
@@ -231,6 +231,26 @@
             },
         }
     }
+    pub fn to_fidl_subnet(&self) -> fidl_fuchsia_net::Subnet {
+        match self.address {
+            IpAddr::V4(a) => fidl_fuchsia_net::Subnet {
+                addr: fidl_fuchsia_net::IpAddress::Ipv4(fidl_fuchsia_net::Ipv4Address {
+                    addr: (u32::from_be_bytes(a.octets()) >> (32 - self.prefix)
+                        << (32 - self.prefix))
+                        .to_be_bytes(),
+                }),
+                prefix_len: self.prefix,
+            },
+            IpAddr::V6(a) => fidl_fuchsia_net::Subnet {
+                addr: fidl_fuchsia_net::IpAddress::Ipv6(fidl_fuchsia_net::Ipv6Address {
+                    addr: (u128::from_be_bytes(a.octets()) >> (128 - self.prefix)
+                        << (128 - self.prefix))
+                        .to_be_bytes(),
+                }),
+                prefix_len: self.prefix,
+            },
+        }
+    }
     pub fn to_fidl_interface_address(&self) -> fidl_fuchsia_net_stack::InterfaceAddress {
         match self.address {
             IpAddr::V4(a) => fidl_fuchsia_net_stack::InterfaceAddress {
@@ -367,6 +387,7 @@
     #![allow(unused)]
     use super::*;
     use crate::portmgr::{Port, PortManager};
+    use fidl_fuchsia_net::Ipv4Address;
 
     fn create_ports() -> PortManager {
         let mut pm = PortManager::new();
@@ -740,4 +761,45 @@
             }
         );
     }
+
+    fn build_lif_subnet(
+        lifip_addr: &str,
+        expected_addr: &str,
+        prefix_len: u8,
+    ) -> (LifIpAddr, fidl_fuchsia_net::Subnet) {
+        let lifip = LifIpAddr { address: lifip_addr.parse().unwrap(), prefix: prefix_len };
+
+        let ip: IpAddr = expected_addr.parse().unwrap();
+        let expected_subnet = fidl_fuchsia_net::Subnet {
+            addr: fidl_fuchsia_net::IpAddress::Ipv4(Ipv4Address {
+                addr: match ip {
+                    std::net::IpAddr::V4(v4addr) => v4addr.octets(),
+                    std::net::IpAddr::V6(_) => panic!("unexpected ipv6 address"),
+                },
+            }),
+            prefix_len,
+        };
+        (lifip, expected_subnet)
+    }
+
+    #[test]
+    fn test_fidl_subnet_math() {
+        let (lifip, expected_subnet) = build_lif_subnet("169.254.10.10", "169.254.10.10", 32);
+        assert_eq!(lifip.to_fidl_subnet(), expected_subnet);
+
+        let (lifip, expected_subnet) = build_lif_subnet("169.254.10.10", "169.254.10.0", 24);
+        assert_eq!(lifip.to_fidl_subnet(), expected_subnet);
+
+        let (lifip, expected_subnet) = build_lif_subnet("169.254.10.10", "169.254.0.0", 16);
+        assert_eq!(lifip.to_fidl_subnet(), expected_subnet);
+
+        let (lifip, expected_subnet) = build_lif_subnet("169.254.10.10", "169.0.0.0", 8);
+        assert_eq!(lifip.to_fidl_subnet(), expected_subnet);
+
+        let (lifip, expected_subnet) = build_lif_subnet("169.254.127.254", "169.254.124.0", 22);
+        assert_eq!(lifip.to_fidl_subnet(), expected_subnet);
+
+        let (lifip, expected_subnet) = build_lif_subnet("16.25.12.25", "16.16.0.0", 12);
+        assert_eq!(lifip.to_fidl_subnet(), expected_subnet);
+    }
 }
diff --git a/src/connectivity/management/network_manager/core/src/packet_filter.rs b/src/connectivity/management/network_manager/core/src/packet_filter.rs
index 78c3fe5..67cb6cc 100644
--- a/src/connectivity/management/network_manager/core/src/packet_filter.rs
+++ b/src/connectivity/management/network_manager/core/src/packet_filter.rs
@@ -4,10 +4,12 @@
 
 //! Handles packet filtering requests for Network Manager.
 
+use crate::servicemgr::NatConfig;
 use failure::{format_err, Error};
 use fidl_fuchsia_net_filter::{self as netfilter, Direction, FilterMarker, FilterProxy, Status};
 use fidl_fuchsia_router_config as router_config;
 use fuchsia_component::client::connect_to_service;
+use std::net::IpAddr;
 
 /// Storage for this PacketFilter's attributes.
 pub struct PacketFilter {
@@ -183,6 +185,30 @@
     Ok(Some(Box::new(fidl_fuchsia_net::Subnet { addr, prefix_len })))
 }
 
+/// Parses a [`servicemgr::NatConfig`] and extracts the required fields.
+fn from_nat_config(
+    nat_config: &NatConfig,
+) -> Result<(fidl_fuchsia_net::Subnet, fidl_fuchsia_net::IpAddress, u32), Error> {
+    let src_subnet = match &nat_config.local_subnet {
+        Some(subnet) => subnet.clone().to_fidl_subnet(),
+        None => return Err(format_err!("NatConfig must have a local_subnet set")),
+    };
+    let wan_ip = match nat_config.global_ip.clone() {
+        Some(lif) => match lif.address {
+            IpAddr::V4(a) => fidl_fuchsia_net::IpAddress::Ipv4(fidl_fuchsia_net::Ipv4Address {
+                addr: a.octets(),
+            }),
+            IpAddr::V6(_) => return Err(format_err!("IPv6 is not supported")),
+        },
+        None => return Err(format_err!("NatConfig must have a global_ip set")),
+    };
+    let nicid = match nat_config.pid {
+        Some(pid) => pid.to_u32(),
+        None => return Err(format_err!("NatConfig must have a pid set")),
+    };
+    Ok((src_subnet, wan_ip, nicid))
+}
+
 /// Manages a Packet Filter connection to netstack filter service (netfilter).
 ///
 /// Mainly serves as a wrapper around the netfilter service. Converts Network Manager FIDL APIs into
@@ -232,6 +258,7 @@
     /// include in the request.
     ///
     /// # Error
+    ///
     /// If we fail to get the generation number from the netfilter service, or the result of the
     /// request to netfilter is anything other than [`netfilter::Status::Ok`] then produce an error
     /// result. Failure to convert the [`router_config::FilterRule`] to a [`netfilter::Rule`] will
@@ -255,12 +282,79 @@
             Err(e) => Err(format_err!("fidl error: {:?}", e)),
         }
     }
+
+    /// Installs a Network Address Translation (NAT) rule.
+    ///
+    /// This method calls the netfilter API to install a rule that rewrites source addresses on the
+    /// LAN side with a publicly routable IP address (SNAT). Reverse translation (DNAT) is handled
+    /// by netstack's connection state tracker.
+    ///
+    /// # Error
+    ///
+    /// If we fail to get the generation number from the netfilter service, or fail to update the
+    /// the NAT ruleset, then we'll return an error result to the caller.
+    ///
+    /// A complete [`servicemgr::NatConfig`] is required at this point. If any fields are missing,
+    /// then an appropriate error will be returned to the caller.
+    // TODO(cgibson): Currently there is no way for this to be called. Add a method to the CLI
+    // to actually enable NAT, which would allow this method to run: fxb/35788.
+    pub async fn update_nat(&self, nat_config: &mut NatConfig) -> Result<(), Error> {
+        info!("Received request to enable NAT");
+        let (src_subnet, wan_ip, nicid) = from_nat_config(nat_config)
+            .map_err(|e| format_err!("Failed to parse NAT config: {:?}", e))?;
+
+        // TODO(cgibson): NAT should work on IP packets, we shouldn't need to provide a proto field
+        // here. This is a bug: fxb/35950.
+        //
+        // Ultimately this should all collapse into a single rule.
+        let mut nat_rules = vec![
+            netfilter::Nat {
+                proto: netfilter::SocketProtocol::Tcp,
+                src_subnet: src_subnet.clone(),
+                new_src_addr: wan_ip.clone(),
+                nic: nicid,
+            },
+            netfilter::Nat {
+                proto: netfilter::SocketProtocol::Udp,
+                src_subnet: src_subnet.clone(),
+                new_src_addr: wan_ip.clone(),
+                nic: nicid,
+            },
+            netfilter::Nat {
+                proto: netfilter::SocketProtocol::Icmp,
+                src_subnet: src_subnet.clone(),
+                new_src_addr: wan_ip.clone(),
+                nic: nicid,
+            },
+        ];
+
+        // Since we discard any existing NAT rules here, this is a pure "update-only" situation.
+        let generation: u32 = match self.filter_svc.get_nat_rules().await {
+            Ok((_, generation, Status::Ok)) => generation,
+            Ok((_, _, status)) => {
+                return Err(format_err!(
+                    "Failed to get generation number! Status was: {:?}",
+                    status
+                ))
+            }
+            Err(e) => return Err(format_err!("fidl error: {:?}", e)),
+        };
+        // TODO(cgibson): When we add the CLI command to enable/disable NAT, we will be able to use
+        // our CLI integration framework to test this.
+        match self.filter_svc.update_nat_rules(&mut nat_rules.iter_mut(), generation).await {
+            Ok(Status::Ok) => Ok(()),
+            Ok(status) => Err(format_err!("failed to set NAT state: {:?}", status)),
+            Err(e) => Err(format_err!("fidl error: {:?}", e)),
+        }
+    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    use crate::hal;
+    use crate::lifmgr::LifIpAddr;
     use fidl_fuchsia_net::IpAddress::Ipv4;
     use fidl_fuchsia_net::Ipv4Address;
     use fidl_fuchsia_router_config::{
@@ -430,4 +524,85 @@
         let both = from_protocol(Some(router_config::Protocol::Both));
         assert_eq!(both.is_none(), true);
     }
+
+    #[test]
+    fn test_from_nat_config() {
+        let expected_subnet_lifip =
+            LifIpAddr { address: "192.168.0.0".parse().unwrap(), prefix: 24 };
+        let expected_lifip = LifIpAddr { address: "17.0.0.1".parse().unwrap(), prefix: 32 };
+        let ip: IpAddr = "192.168.0.0".parse().unwrap();
+        let expected_subnet = fidl_fuchsia_net::Subnet {
+            addr: fidl_fuchsia_net::IpAddress::Ipv4(Ipv4Address {
+                addr: match ip {
+                    std::net::IpAddr::V4(v4addr) => v4addr.octets(),
+                    std::net::IpAddr::V6(_) => panic!("unexpected ipv6 address"),
+                },
+            }),
+            prefix_len: 24,
+        };
+        let expected_pid = hal::PortId::from(1);
+
+        // should fail if all fields are set to None.
+        let mut nat_config = NatConfig {
+            enable: true, // not being validated, so we don't care what this is set to.
+            local_subnet: None,
+            global_ip: None,
+            pid: None,
+        };
+        let result = from_nat_config(&mut nat_config);
+        assert_eq!(result.is_err(), true);
+
+        // should fail if local_subnet is missing.
+        let mut nat_config = NatConfig {
+            enable: true, // not being validated, so we don't care what this is set to.
+            local_subnet: None,
+            global_ip: Some(expected_lifip.clone()),
+            pid: Some(expected_pid),
+        };
+        let result = from_nat_config(&mut nat_config);
+        assert_eq!(result.is_err(), true);
+
+        // should fail if global_ip is missing.
+        let mut nat_config = NatConfig {
+            enable: true, // not being validated, so we don't care what this is set to.
+            local_subnet: Some(expected_subnet_lifip.clone()),
+            global_ip: None,
+            pid: Some(expected_pid),
+        };
+        let result = from_nat_config(&mut nat_config);
+        assert_eq!(result.is_err(), true);
+
+        // should fail if pid is missing.
+        let mut nat_config = NatConfig {
+            enable: true, // not being validated, so we don't care what this is set to.
+            local_subnet: Some(expected_subnet_lifip.clone()),
+            global_ip: Some(expected_lifip.clone()),
+            pid: None,
+        };
+        let result = from_nat_config(&mut nat_config);
+        assert_eq!(result.is_err(), true);
+
+        // should pass when all fields are present.
+        let expected_wan_ip = fidl_fuchsia_net::IpAddress::Ipv4(fidl_fuchsia_net::Ipv4Address {
+            addr: match expected_lifip.clone().address {
+                IpAddr::V4(v4addr) => v4addr.octets(),
+                IpAddr::V6(_) => panic!("unexpected ipv6 address"),
+            },
+        });
+        let mut nat_config = NatConfig {
+            enable: true, // not being validated, so we don't care what this is set to.
+            local_subnet: Some(expected_subnet_lifip.clone()),
+            global_ip: Some(expected_lifip.clone()),
+            pid: Some(expected_pid),
+        };
+        let result = from_nat_config(&mut nat_config);
+        assert_eq!(result.is_ok(), true);
+        let (actual_subnet, actual_wan_ip, actual_nicid) = match result {
+            Ok((s, w, n)) => (s, w, n),
+            Err(e) => panic!("NatConfig test failed: {:?}", e),
+        };
+        assert_eq!(expected_subnet, actual_subnet);
+        assert_eq!(expected_wan_ip, actual_wan_ip);
+        assert_eq!(expected_pid.to_u32(), actual_nicid);
+    }
 }
diff --git a/src/connectivity/management/network_manager/core/src/servicemgr.rs b/src/connectivity/management/network_manager/core/src/servicemgr.rs
index 70133f1..c06701f 100644
--- a/src/connectivity/management/network_manager/core/src/servicemgr.rs
+++ b/src/connectivity/management/network_manager/core/src/servicemgr.rs
@@ -13,10 +13,22 @@
 // TODO(dpradilla): remove allow
 #![allow(dead_code)]
 
-use crate::lifmgr::LIF;
+use crate::hal::PortId;
+use crate::lifmgr::{LifIpAddr, LIF};
 use crate::{error, UUID};
 use std::collections::HashSet;
 
+pub struct NatConfig {
+    pub enable: bool,
+    pub local_subnet: Option<LifIpAddr>,
+    pub global_ip: Option<LifIpAddr>,
+    pub pid: Option<PortId>,
+}
+
+struct SecurityFeatures {
+    nat: NatConfig,
+}
+
 /// `Manager` keeps track of interfaces where a service is enabled
 /// and verifies conflicting services are not enabled.
 pub struct Manager {
@@ -24,12 +36,20 @@
     dhcp_server: std::collections::HashSet<UUID>,
     // dhcp_client has collection of interfaces DHCP dhcp_client is enabled.
     dhcp_client: std::collections::HashSet<UUID>,
+    // security features.
+    security: SecurityFeatures,
 }
 
 impl Manager {
     //! Creates a new Manager.
     pub fn new() -> Self {
-        Manager { dhcp_server: HashSet::new(), dhcp_client: HashSet::new() }
+        Manager {
+            dhcp_server: HashSet::new(),
+            dhcp_client: HashSet::new(),
+            security: SecurityFeatures {
+                nat: NatConfig { enable: false, local_subnet: None, global_ip: None, pid: None },
+            },
+        }
     }
     /// `enable_server` sets dhcp dhcp_server as enabled on indicated interface.
     pub fn enable_server(&mut self, lif: &LIF) -> error::Result<bool> {
@@ -61,12 +81,37 @@
     pub fn is_client_enabled(&mut self, lif: &LIF) -> bool {
         self.dhcp_client.contains(&lif.id().uuid)
     }
+    /// `is_nat_enabled` returns true if NAT is enabled.
+    pub fn is_nat_enabled(&mut self) -> bool {
+        self.security.nat.enable
+    }
+    /// `enable_nat` method indicates that NAT is now enabled.
+    pub fn enable_nat(&mut self) {
+        self.security.nat.enable = true;
+    }
+    /// `disable_nat` method indicates that NAT is now disabled.
+    pub fn disable_nat(&mut self) {
+        self.security.nat.enable = false;
+    }
+    /// `get_nat_config` returns the current NAT configuration.
+    pub fn get_nat_config(&mut self) -> &mut NatConfig {
+        &mut self.security.nat
+    }
+    /// `set_local_subnet_nat` sets the local subnet to be NATed.
+    pub fn set_local_subnet_nat(&mut self, s: LifIpAddr) {
+        self.security.nat.local_subnet = Some(s);
+    }
+    /// `set_global_ip_nat` sets the global IP to be NATed.
+    pub fn set_global_ip_nat(&mut self, g: LifIpAddr, p: PortId) {
+        self.security.nat.global_ip = Some(g);
+        self.security.nat.pid = Some(p);
+    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::lifmgr::{LIFType, LIF};
+    use crate::lifmgr::{LIFType, LifIpAddr, LIF};
     use crate::portmgr::PortId;
     use crate::portmgr::{Port, PortManager};
 
@@ -191,4 +236,26 @@
         assert!(!m.enable_client(&l).unwrap_or(false));
         assert_eq!(m.dhcp_client.len(), 0);
     }
+
+    #[test]
+    fn test_nat_config() {
+        let mut m = Manager::new();
+
+        assert_eq!(m.get_nat_config().enable, false);
+        assert_eq!(m.is_nat_enabled(), false);
+
+        m.enable_nat();
+        assert_eq!(m.is_nat_enabled(), true);
+
+        m.disable_nat();
+        assert_eq!(m.is_nat_enabled(), false);
+
+        let lifip = LifIpAddr { address: "169.254.0.1".parse().unwrap(), prefix: 32 };
+        m.set_local_subnet_nat(lifip.clone());
+        assert_eq!(m.get_nat_config().local_subnet.as_ref().unwrap(), &lifip);
+
+        let pid = PortId::from(1);
+        m.set_global_ip_nat(lifip.clone(), pid);
+        assert_eq!(m.get_nat_config().pid.unwrap(), pid);
+    }
 }
diff --git a/src/connectivity/management/network_manager/src/eventloop.rs b/src/connectivity/management/network_manager/src/eventloop.rs
index ae773d4..58af16a 100644
--- a/src/connectivity/management/network_manager/src/eventloop.rs
+++ b/src/connectivity/management/network_manager/src/eventloop.rs
@@ -82,7 +82,6 @@
 pub struct EventLoop {
     event_recv: Option<mpsc::UnboundedReceiver<Event>>,
     device: DeviceState,
-    packet_filter: PacketFilter,
 }
 
 impl EventLoop {
@@ -96,10 +95,10 @@
         let packet_filter = PacketFilter::start()
             .context("network_manager failed to start packet filter!")
             .unwrap();
+
         Ok(EventLoop {
             event_recv: Some(event_recv),
-            device: DeviceState::new(netcfg),
-            packet_filter,
+            device: DeviceState::new(netcfg, packet_filter),
         })
     }
 
@@ -109,6 +108,7 @@
             self.event_recv.take().unwrap(),
             self.device.take_event_stream().map(|e| Event::StackObservable(e)),
         );
+
         loop {
             match select_stream.next().await {
                 Some(Event::FidlRouterAdminEvent(req)) => {
@@ -277,7 +277,7 @@
             }
             RouterAdminRequest::SetFilter { rule, responder } => {
                 let r = self
-                    .packet_filter
+                    .device
                     .set_filter(rule)
                     .await
                     .context("Error installing new packet filter rule");
@@ -553,8 +553,7 @@
                 responder.send(None, not_supported!())
             }
             RouterStateRequest::GetFilters { responder } => {
-                let result =
-                    self.packet_filter.get_filters().await.context("Error getting filters");
+                let result = self.device.get_filters().await.context("Error getting filters");
                 let mut filter_rules = Vec::new();
                 match result {
                     Ok(f) => {