diff --git a/ararat/deploy.py b/ararat/deploy.py
index d0e52a7..13c4305 100644
--- a/ararat/deploy.py
+++ b/ararat/deploy.py
@@ -53,12 +53,56 @@ openrc.service(
 )
 
 # add networking: https://wiki.alpinelinux.org/wiki/KVM#Networking
-# modprobe tun
+server.modprobe(
+    name="activate tun kernel module",
+    module="tun",
+)
 # echo "tun" >> /etc/modules-load.d/tun.conf
+files.line(
+    name="autostart tun",
+    path="/etc/modules-load.d/tun.conf",
+    line="tun",
+)
 # cat /etc/modules | grep tun || echo tun >> /etc/modules
+#files.line(path="/etc/modules",line="tun")
+# add VMs to public network:
+virsh_network_guests = []
+for vm in inventory.groups.get("debian_vms"):
+    #sudo ip addr add 65.109.242.20 dev eth0
+    ipv4 = vm.data.get("ipv4")
+    mac_address = '52:54:00:6c:3c:%02x'%vm.data.get("id")
+    files.template(
+        name=f"Add {ipv4} for {vm} to ararat",
+        src="ararat/files/floating-ip.cfg.j2",
+        dest=f"/etc/network/interfaces.d/60-{vm}-floating-up.cfg",  # doesn't work, interfaces.d isn't included
+        vm=vm,
+        ipv4=ipv4,
+    )
+    #server.shell(name=f"Add {ipv4} for {vm} to ararat", commands=[f"ip addr add {ipv4} dev eth{vm}"],)
+    virsh_network_guests.append(f"<host mac='{mac_address}' name='{vm}' ip='{ipv4}' />")
+openrc.service(
+    service="networking",
+    restarted=True,
+)
+
+# create public kvm network
+files.template(
+    name="Generate libvirt public network XML",
+    src="ararat/files/public.network.j2",
+    dest="/tmp/public.network",
+    guests='\n      '.join(virsh_network_guests),
+    host_ipv4=host.name,
+)
+server.shell(
+    name="Update libvirt public network",
+    commands=[
+        "virsh net-destroy public ; virsh net-undefine public || true",
+        "virsh net-define /tmp/public.network",
+        "virsh net-start public",
+    ]
+)
+# disable ipv6 in a bridge if necessary
 
-# if it doesn't exist, create debian base image (later: and other base images): https://mop.koeln/blog/creating-a-local-debian-vm-using-cloud-init-and-libvirt/#download-the-image
-# for every active VM, if no image exists, run virt-install with the chosen base image and their cloud-init.yml file: https://mop.koeln/blog/creating-a-local-debian-vm-using-cloud-init-and-libvirt/#preparing-a-cloud-init-file
 debian_image_path = "/var/lib/libvirt/images/debian-12-generic-amd64.qcow2"
 files.download(
     name="Download Debian 12 base image",
@@ -86,15 +130,16 @@ for vm in inventory.groups.get("debian_vms"):
             dest=f"/root/{vm}-cloud-init.yml",
             ssh_authorized_keys=authorized_keys,
         )
+        mac_address = '52:54:00:6c:3c:%02x' % vm.data.get("id")
         memory = 1024
         vcpus = 1
         disk_size = 4
         server.shell(
             name=f"virt-install {vm}",
             commands=[
+                f"virsh list -all | grep {vm} || "  # only run virt-install if VM doesn't exist yet
                 f"virt-install --name {vm} --disk=size={disk_size},backing_store={debian_image_path} "
                 f"--memory {memory} --vcpus {vcpus} --cloud-init user-data=/root/{vm}-cloud-init.yml,disable=on "
-                "--network bridge=virbr0 --osinfo=debian12 || true",
+                f"--network 'bridge=virbr0,network=public,mac_address={mac_address}' --osinfo=debian12 || true",
             ]
         )
-    # for every active VM, make sure an IP is assigned and traffic is passed to it
diff --git a/ararat/files/floating-ip.cfg.j2 b/ararat/files/floating-ip.cfg.j2
new file mode 100644
index 0000000..ba6a286
--- /dev/null
+++ b/ararat/files/floating-ip.cfg.j2
@@ -0,0 +1,4 @@
+auto eth0:{{ vm }}
+iface eth0:{{ vm }} inet static
+    address {{ ipv4 }}
+    netmask 32
diff --git a/ararat/files/public.network.j2 b/ararat/files/public.network.j2
new file mode 100644
index 0000000..d6635a6
--- /dev/null
+++ b/ararat/files/public.network.j2
@@ -0,0 +1,10 @@
+<network>
+  <name>public</name>
+  <forward mode='route' />
+  <bridge />
+  <ip address='{{ host_ipv4 }}' prefix='32'>
+    <dhcp>
+      {{ guests }}
+    </dhcp>
+  </ip>
+</network>
diff --git a/inventory.py b/inventory.py
index ab5dd73..2eec2c2 100644
--- a/inventory.py
+++ b/inventory.py
@@ -8,6 +8,8 @@ debian_vms = [
         "playground",
         {
             "authorized_keys": ["missytake", "hagi", "vmann"],
+            "ipv4": "65.109.242.20",
+            "id": 0,
         }
      ),
 ]