diff --git a/xos/synchronizer/templates/start-veg.sh.j2 b/xos/synchronizer/templates/start-veg.sh.j2
new file mode 100755
index 0000000..5f21abf
--- /dev/null
+++ b/xos/synchronizer/templates/start-veg.sh.j2
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+function mac_to_iface {
+    MAC=$1
+    ifconfig|grep $MAC| awk '{print $1}'|grep -v '\.'
+}
+
+iptables -L > /dev/null
+ip6tables -L > /dev/null
+
+STAG={{ s_tags[0] }}
+CTAG={{ c_tags[0] }}
+VEG=veg-$STAG-$CTAG
+
+docker inspect $VEG > /dev/null 2>&1
+if [ "$?" == 1 ]
+then
+    docker pull andybavier/docker-veg
+    docker run -d --name=$VEG --privileged=true --net=none -v /etc/$VEG/dnsmasq.d:/etc/dnsmasq.d andybavier/docker-veg
+else
+    docker start $VEG
+fi
+
+# Set up networking via pipework
+WAN_IFACE=$( mac_to_iface {{ wan_mac }} )
+docker exec $VEG ifconfig eth0 >> /dev/null || pipework $WAN_IFACE -i eth0 $VEG {{ wan_ip }}/24@{{ wan_next_hop }} {{ wan_container_mac }}
+
+# LAN_IFACE=$( mac_to_iface {{ lan_mac }} )
+# Need to encapsulate VLAN traffic so that Neutron doesn't eat it
+# Assumes that br-lan has been set up appropriately by a previous step
+LAN_IFACE=br-lan
+ifconfig $LAN_IFACE >> /dev/null
+if [ "$?" == 0 ]
+then
+    ifconfig $LAN_IFACE.$STAG >> /dev/null || ip link add link $LAN_IFACE name $LAN_IFACE.$STAG type vlan id $STAG
+    ifconfig $LAN_IFACE.$STAG up
+    docker exec $VEG ifconfig eth1 >> /dev/null || pipework $LAN_IFACE.$STAG -i eth1 $VEG 192.168.0.1/24 @$CTAG
+fi
+
+#HPC_IFACE=$( mac_to_iface {{ hpc_client_mac }} )
+#docker exec $VEG ifconfig eth2 >> /dev/null || pipework $HPC_IFACE -i eth2 $VEG {{ hpc_client_ip }}/24
+
+# Make sure VM's eth0 (hpc_client) has no IP address
+#ifconfig $HPC_IFACE 0.0.0.0
+
+# Now can start up dnsmasq
+docker exec $VEG service dnsmasq start
+
+# Attach to container
+docker start -a $VEG