diff --git a/debian/changelog b/debian/changelog
index 6c763d2d8..e7aef6f7f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -21,6 +21,7 @@ systemd (219-1) UNRELEASED; urgency=medium
     Debian) to make the ACL for "adm" actually work.
   * debian/rules: Explicitly disable importd for now; it should still mature a
     bit. Explicitly enable hwdb support.
+  * Enable libiptc support for networkd masquerading/NAT.
   * /lib/lsb/init-functions.d/40-systemd: Call systemctl is-system-running
     with --quiet. (LP: #1421058)
   * debian/systemd.postrm: Clean getty@tty1.service and remote-fs.target
diff --git a/debian/control b/debian/control
index fcad68cfd..fbcfa7344 100644
--- a/debian/control
+++ b/debian/control
@@ -35,6 +35,7 @@ Build-Depends: debhelper (>= 9),
                libkmod-dev (>= 15),
                libblkid-dev (>= 2.24),
                libmount-dev (>= 2.20),
+               iptables-dev,
                libgirepository1.0-dev (>= 1.31.1),
                gobject-introspection (>= 1.31.1),
                python3-all-dev,
diff --git a/debian/rules b/debian/rules
index 4da66dff0..22d14ffd8 100755
--- a/debian/rules
+++ b/debian/rules
@@ -50,6 +50,7 @@ CONFFLAGS_deb = \
 	--enable-gtk-doc \
 	--enable-compat-libs \
 	--enable-hwdb \
+	--enable-libiptc \
 	PYTHON=python3
 
 CONFFLAGS_udeb = \
@@ -82,6 +83,7 @@ CONFFLAGS_udeb = \
 	--disable-gudev \
 	--disable-rfkill \
 	--disable-hwdb \
+	--disable-libiptc \
 	--disable-manpages \
 	--without-python