diff --git a/ansible/roles/ironic/defaults/main.yml b/ansible/roles/ironic/defaults/main.yml
index e56eb25587..d20a4d0857 100644
--- a/ansible/roles/ironic/defaults/main.yml
+++ b/ansible/roles/ironic/defaults/main.yml
@@ -51,6 +51,8 @@ ironic_services:
     container_name: ironic_dnsmasq
     group: ironic-inspector
     enabled: true
+    cap_add:
+      - NET_ADMIN
     image: "{{ ironic_dnsmasq_image_full }}"
     volumes:
       - "{{ node_config_directory }}/ironic-dnsmasq/:{{ container_config_directory }}/:ro"
diff --git a/ansible/roles/ironic/handlers/main.yml b/ansible/roles/ironic/handlers/main.yml
index cca0a45ac4..f32e73ada2 100644
--- a/ansible/roles/ironic/handlers/main.yml
+++ b/ansible/roles/ironic/handlers/main.yml
@@ -103,6 +103,7 @@
     name: "{{ service.container_name }}"
     image: "{{ service.image }}"
     volumes: "{{ service.volumes }}"
+    cap_add: "{{ service.cap_add }}"
   when:
     - action != "config"
     - inventory_hostname in groups[service.group]
diff --git a/ansible/roles/ironic/tasks/config.yml b/ansible/roles/ironic/tasks/config.yml
index c91337d1c5..63e57c6cf7 100644
--- a/ansible/roles/ironic/tasks/config.yml
+++ b/ansible/roles/ironic/tasks/config.yml
@@ -196,6 +196,7 @@
     name: "{{ item.value.container_name }}"
     image: "{{ item.value.image }}"
     privileged: "{{ item.value.privileged|default(False) }}"
+    cap_add: "{{ item.value.cap_add|default([]) }}"
     volumes: "{{ item.value.volumes }}"
   register: check_ironic_containers
   when: