diff --git a/install-stack.sh b/install-stack.sh
index 506ea10..0970614 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -59,16 +59,41 @@ detect_storage() {
 }
 STORAGE=$(detect_storage)
 
-# ── Check vmbr1 internal bridge ───────────────────────────────────────────────
+# ── Internal network: bridge + NAT ────────────────────────────────────────────
+# The isolated vmbr1 needs outbound NAT so LXCs can apt-install Docker, git
+# clone, and pull images. Persisted via an if-up.d hook so it survives reboot.
+ensure_nat() {
+  local wan; wan=$(ip route show default 2>/dev/null | awk '{print $5; exit}'); wan=${wan:-vmbr0}
+  msg_info "Enabling internal NAT (10.10.10.0/24 → ${wan})"
+  sysctl -wq net.ipv4.ip_forward=1 2>/dev/null || echo 1 > /proc/sys/net/ipv4/ip_forward
+  echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-hotel-manage.conf
+  iptables -t nat -C POSTROUTING -s 10.10.10.0/24 ! -d 10.10.10.0/24 -o "$wan" -j MASQUERADE 2>/dev/null \
+    || iptables -t nat -A POSTROUTING -s 10.10.10.0/24 ! -d 10.10.10.0/24 -o "$wan" -j MASQUERADE
+  cat > /etc/network/if-up.d/hotel-manage-nat <<'HOOK'
+#!/bin/sh
+[ "$IFACE" = "vmbr1" ] || exit 0
+WAN=$(ip route show default | awk '{print $5; exit}'); WAN=${WAN:-vmbr0}
+sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1
+iptables -t nat -C POSTROUTING -s 10.10.10.0/24 ! -d 10.10.10.0/24 -o "$WAN" -j MASQUERADE 2>/dev/null \
+  || iptables -t nat -A POSTROUTING -s 10.10.10.0/24 ! -d 10.10.10.0/24 -o "$WAN" -j MASQUERADE
+HOOK
+  chmod +x /etc/network/if-up.d/hotel-manage-nat
+  msg_ok "Internal NAT enabled (via ${wan})"
+}
+
 check_vmbr1() {
-  ip link show vmbr1 &>/dev/null && return   # already present
+  if ip link show vmbr1 &>/dev/null; then
+    ensure_nat   # bridge exists — make sure NAT/forwarding is in place
+    return
+  fi
 
   if whiptail --title "Create internal bridge vmbr1?" --yesno \
 "The internal container bridge vmbr1 (10.10.10.1/24) doesn't exist yet.
 
 Create it now?  This adds an ISOLATED bridge with no physical ports,
 so it cannot affect your LAN or vmbr0. It appends a stanza to
-/etc/network/interfaces and applies it with ifreload -a." 14 68; then
+/etc/network/interfaces, applies it with ifreload -a, and enables
+outbound NAT so the containers can reach the internet." 15 68; then
 
     if grep -qE '^\s*iface\s+vmbr1' /etc/network/interfaces 2>/dev/null; then
       msg_warn "vmbr1 already defined in /etc/network/interfaces — applying it"
@@ -91,6 +116,7 @@ EOF
     else
       msg_error "vmbr1 still not up — check /etc/network/interfaces and re-run"
     fi
+    ensure_nat
   else
     whiptail --title "vmbr1 Missing" --msgbox \
 "Cancelled. Add this to /etc/network/interfaces, run 'ifreload -a',