diff --git a/pkgs/development/ocaml-modules/mirage-nat/default.nix b/pkgs/development/ocaml-modules/mirage-nat/default.nix
new file mode 100644
index 000000000000..5edf8a347ad0
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mirage-nat/default.nix
@@ -0,0 +1,50 @@
+{ lib, buildDunePackage, fetchurl
+, ipaddr, cstruct, lwt, rresult, logs, lru
+, tcpip, ethernet, stdlib-shims
+, alcotest, mirage-clock-unix
+, ppx_deriving
+}:
+
+buildDunePackage rec {
+  pname = "mirage-nat";
+  version = "2.2.3";
+
+  minimumOCamlVersion = "4.06";
+
+  # due to cstruct
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
+    sha256 = "0cy95j184hi8fm1h6z6x1brjfrmbq3zjy2mqz99m8ys9vwkb63ma";
+  };
+
+  nativeBuildInputs = [
+    ppx_deriving
+  ];
+
+  propagatedBuildInputs = [
+    ipaddr
+    cstruct
+    lwt
+    rresult
+    logs
+    lru
+    tcpip
+    ethernet
+    stdlib-shims
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    alcotest
+    mirage-clock-unix
+  ];
+
+  meta = with lib; {
+    description = "Mirage-nat is a library for network address translation to be used with MirageOS";
+    homepage = "https://github.com/mirage/${pname}";
+    license = licenses.isc;
+    maintainers = [ maintainers.sternenseemann ];
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 49bddde6f550..e2dc6a7052af 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -589,6 +589,8 @@ let
 
     mirage-logs = callPackage ../development/ocaml-modules/mirage-logs { };
 
+    mirage-nat = callPackage ../development/ocaml-modules/mirage-nat { };
+
     mirage-net = callPackage ../development/ocaml-modules/mirage-net { };
 
     mirage-profile = callPackage ../development/ocaml-modules/mirage-profile { };