diff --git a/labs/config/openstack b/labs/config/openstack
index 1e2446db..1070668c 100644
--- a/labs/config/openstack
+++ b/labs/config/openstack
@@ -21,5 +21,9 @@
 # DEMO_NET
 : ${TENANT_NETWORK_GATEWAY:=172.16.0.1}
 : ${TENANT_NETWORK_CIDR:=172.16.0.0/24}
+# Comma-separated list of DNS name servers used by dnsmasq to serve instance
+# VMs in neutron subnets with dns_nameservers unset.
+# Default is Google Public DNS (8.8.8.8); to disable, set to "".
+: ${TENANT_VM_DNS_SERVER:=8.8.8.8}
 
 # vim: set ai ts=4 sw=4 et ft=sh:
diff --git a/labs/scripts/setup_neutron_network.sh b/labs/scripts/setup_neutron_network.sh
index aebe302b..f08faa7f 100755
--- a/labs/scripts/setup_neutron_network.sh
+++ b/labs/scripts/setup_neutron_network.sh
@@ -3,6 +3,7 @@ TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 source "$TOP_DIR/config/paths"
 source "$CONFIG_DIR/credentials"
 source "$LIB_DIR/functions.guest"
+source "$CONFIG_DIR/openstack"
 exec_logfile
 
 indicate_current_auto
@@ -133,10 +134,23 @@ iniset_sudo $conf DEFAULT use_namespaces True
 iniset_sudo $conf DEFAULT verbose True
 iniset_sudo $conf DEFAULT dnsmasq_config_file /etc/neutron/dnsmasq-neutron.conf
 
+if [ -n "${TENANT_VM_DNS_SERVER:-''}" ]; then
+    iniset_sudo $conf DEFAULT dnsmasq_dns_servers "$TENANT_VM_DNS_SERVER"
+fi
+
 cat << DNSMASQ | sudo tee /etc/neutron/dnsmasq-neutron.conf
 # Set interface MTU to 1454 (for instance, ssh authentication may fail
 # otherwise due to GRE overhead)
 dhcp-option-force=26,1454
+
+# Override --no-hosts dnsmasq option supplied by neutron
+addn-hosts=/etc/hosts
+
+# Log dnsmasq queries to syslog
+log-queries
+
+# Verbose logging for DHCP
+log-dhcp
 DNSMASQ
 killall dnsmasq