diff --git a/renderer/templates/services/natlog.uc b/renderer/templates/services/natlog.uc
new file mode 100644
index 00000000..444e4c9d
--- /dev/null
+++ b/renderer/templates/services/natlog.uc
@@ -0,0 +1,5 @@
+{% if (!services.is_present("natlog")) return; %}
+{% services.set_enabled("natlog", natlog.enabled); %}
+
+add natlog defaults
+set natlog.@defaults[0].enabled={{ b(natlog.enabled) }}
diff --git a/schema/service.natlog.yml b/schema/service.natlog.yml
new file mode 100644
index 00000000..825baf8c
--- /dev/null
+++ b/schema/service.natlog.yml
@@ -0,0 +1,9 @@
+description:
+  Whether should device enable NAT logging.
+type: object
+properties:
+  enabled:
+    description:
+      If the kernel module should be enabled, default to false
+    type: boolean
+    default: false
diff --git a/schema/service.yml b/schema/service.yml
index 3b4055f5..a2b5167a 100644
--- a/schema/service.yml
+++ b/schema/service.yml
@@ -52,4 +52,6 @@ properties:
   snmpd:
     $ref: 'https://ucentral.io/schema/v1/service/snmpd/'
   dhcp-inject:
-    $ref: 'https://ucentral.io/schema/v1/service/dhcp-inject/'
\ No newline at end of file
+    $ref: 'https://ucentral.io/schema/v1/service/dhcp-inject/'
+  natlog:
+    $ref: 'https://ucentral.io/schema/v1/service/natlog/'
\ No newline at end of file
diff --git a/schemareader.uc b/schemareader.uc
index b0877947..f8fb2ef3 100644
--- a/schemareader.uc
+++ b/schemareader.uc
@@ -10502,6 +10502,33 @@ function instantiateServiceDhcpInject(location, value, errors) {
 	return value;
 }
 
+function instantiateServiceNatlog(location, value, errors) {
+	if (type(value) == "object") {
+		let obj = {};
+
+		function parseEnabled(location, value, errors) {
+			if (type(value) != "bool")
+				push(errors, [ location, "must be of type boolean" ]);
+
+			return value;
+		}
+
+		if (exists(value, "enabled")) {
+			obj.enabled = parseEnabled(location + "/enabled", value["enabled"], errors);
+		}
+		else {
+			obj.enabled = false;
+		}
+
+		return obj;
+	}
+
+	if (type(value) != "object")
+		push(errors, [ location, "must be of type object" ]);
+
+	return value;
+}
+
 function instantiateService(location, value, errors) {
 	if (type(value) == "object") {
 		let obj = {};
@@ -10606,6 +10633,10 @@ function instantiateService(location, value, errors) {
 			obj.dhcp_inject = instantiateServiceDhcpInject(location + "/dhcp-inject", value["dhcp-inject"], errors);
 		}
 
+		if (exists(value, "natlog")) {
+			obj.natlog = instantiateServiceNatlog(location + "/natlog", value["natlog"], errors);
+		}
+
 		return obj;
 	}
 
diff --git a/ucentral.schema.full.json b/ucentral.schema.full.json
index 69130784..91cba52d 100644
--- a/ucentral.schema.full.json
+++ b/ucentral.schema.full.json
@@ -4774,6 +4774,17 @@
                             }
                         }
                     }
+                },
+                "natlog": {
+                    "description": "Whether should device enable NAT logging.",
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "description": "If the kernel module should be enabled, default to false",
+                            "type": "boolean",
+                            "default": false
+                        }
+                    }
                 }
             }
         },
diff --git a/ucentral.schema.json b/ucentral.schema.json
index 18613427..4cfe9360 100644
--- a/ucentral.schema.json
+++ b/ucentral.schema.json
@@ -3678,6 +3678,15 @@
                 }
             }
         },
+        "service.natlog": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean",
+                    "default": false
+                }
+            }
+        },
         "service": {
             "type": "object",
             "properties": {
@@ -3755,6 +3764,9 @@
                 },
                 "dhcp-inject": {
                     "$ref": "#/$defs/service.dhcp-inject"
+                },
+                "natlog": {
+                    "$ref": "#/$defs/service.natlog"
                 }
             }
         },
diff --git a/ucentral.schema.pretty.json b/ucentral.schema.pretty.json
index 9e5e61e0..6be2094b 100644
--- a/ucentral.schema.pretty.json
+++ b/ucentral.schema.pretty.json
@@ -4245,6 +4245,17 @@
                 }
             }
         },
+        "service.natlog": {
+            "description": "Whether should device enable NAT logging.",
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "description": "If the kernel module should be enabled, default to false",
+                    "type": "boolean",
+                    "default": false
+                }
+            }
+        },
         "service": {
             "description": "This section describes all of the services that may be present on the AP. Each service is then referenced via its name inside an interface, ssid, ...",
             "type": "object",
@@ -4323,6 +4334,9 @@
                 },
                 "dhcp-inject": {
                     "$ref": "#/$defs/service.dhcp-inject"
+                },
+                "natlog": {
+                    "$ref": "#/$defs/service.natlog"
                 }
             }
         },