diff --git a/pkg/netutil/cni_plugin_windows.go b/pkg/netutil/cni_plugin_windows.go
index e8320b10c7e..b57d5bf9186 100644
--- a/pkg/netutil/cni_plugin_windows.go
+++ b/pkg/netutil/cni_plugin_windows.go
@@ -17,9 +17,10 @@
 package netutil
 
 type natConfig struct {
-	PluginType string                 `json:"type"`
-	Master     string                 `json:"master,omitempty"`
-	IPAM       map[string]interface{} `json:"ipam"`
+	PluginType   string                 `json:"type"`
+	Master       string                 `json:"master,omitempty"`
+	IPAM         map[string]interface{} `json:"ipam"`
+	Capabilities map[string]bool        `json:"capabilities,omitempty"`
 }
 
 func (*natConfig) GetPluginType() string {
@@ -30,6 +31,10 @@ func newNatPlugin(master string) *natConfig {
 	return &natConfig{
 		PluginType: "nat",
 		Master:     master,
+		Capabilities: map[string]bool{
+			"portMappings": true,
+			"dns":          true,
+		},
 	}
 }
 
diff --git a/pkg/netutil/netutil_windows_test.go b/pkg/netutil/netutil_windows_test.go
index eb26eef9449..9464f3be8d7 100644
--- a/pkg/netutil/netutil_windows_test.go
+++ b/pkg/netutil/netutil_windows_test.go
@@ -16,10 +16,26 @@
 
 package netutil
 
-import "testing"
+import (
+	"testing"
+
+	"gotest.tools/v3/assert"
+)
 
 // Tests whether nerdctl properly creates the default network when required.
 // On Windows, the default driver used will be "nat". (netutil.DefaultNetworkName)
 func TestDefaultNetworkCreation(t *testing.T) {
 	testDefaultNetworkCreation(t)
 }
+
+func TestGenerateCNIPluginsNatCapabilities(t *testing.T) {
+	e := &CNIEnv{}
+	plugins, err := e.generateCNIPlugins("nat", "nat", nil, nil, false, false)
+	assert.NilError(t, err)
+	assert.Assert(t, len(plugins) == 1)
+	nat, ok := plugins[0].(*natConfig)
+	assert.Assert(t, ok)
+	assert.Assert(t, nat.Capabilities != nil)
+	assert.Assert(t, nat.Capabilities["portMappings"])
+	assert.Assert(t, nat.Capabilities["dns"])
+}