Add per-VM NAT and DNS config

README.md

@@ -25,12 +25,28 @@ Minimal Firecracker launcher.
 - `--vcpu`: defaults to 2, max 16.
 - `--ram`: MiB, defaults to 1024, max 32768.
 - `--disk-size`: M/G suffixes supported; must be >= base `rootfs.ext4` size. Requires `resize2fs`.
+- `DNS_SERVERS`: optional env var for resolv.conf (default: `1.1.1.1`). Requires `debugfs`.
 
 ## SSH
 ```
 ssh -i "./id_ed25519" root@<guest_ip>
 ```
 
+## Internet Access
+VMs do not get internet access by default. You must enable forwarding and NAT:
+```
+./nat.sh up <id-or-name-prefix>
+```
+This enables `net.ipv4.ip_forward=1` and installs per-VM NAT rules for the VM's
+guest IP and TAP device. To remove rules:
+```
+./nat.sh down <id-or-name-prefix>
+```
+Check status with:
+```
+./nat.sh status <id-or-name-prefix>
+```
+
 ## Shutdown
 ```
 reboot