diff --git a/bin/netvm-node-up.sh b/bin/netvm-node-up.sh
index b53f69a..5ddb7bd 100755
--- a/bin/netvm-node-up.sh
+++ b/bin/netvm-node-up.sh
@@ -55,6 +55,14 @@ nsexec ip link set "$WG" up
 nsexec ip route replace default dev "$WG"
 nsexec ip -6 route replace default dev "$WG" 2>/dev/null || true
 
+# CDP bridge: chromium binds DevTools to loopback only; redirect the veth
+# IP:CDP_PORT there so the host (and SSH-forwarded operators) can reach it.
+# (netns iptables is namespaced; rules vanish with the netns on down.)
+nsexec sysctl -qw net.ipv4.conf.all.route_localnet=1
+nsexec sysctl -qw "net.ipv4.conf.${VPEER}.route_localnet=1"
+nsexec iptables -t nat -C PREROUTING -d "$PEER_IP" -p tcp --dport "$CDP_PORT" -j REDIRECT --to-port "$CDP_PORT" 2>/dev/null || \
+nsexec iptables -t nat -A PREROUTING -d "$PEER_IP" -p tcp --dport "$CDP_PORT" -j REDIRECT --to-port "$CDP_PORT"
+
 # wait for handshake (first one can take ~10s)
 HS=""
 for i in $(seq 1 10); do