diff --git a/ansible/kolla-ansible.yml b/ansible/kolla-ansible.yml
index bc8026a6f5a707a0f9304919296e6e9a15c55b9f..f2ccc343248b2df4a04e5b0095a4e7e9eae870de 100644
--- a/ansible/kolla-ansible.yml
+++ b/ansible/kolla-ansible.yml
@@ -100,6 +100,7 @@
         kolla_selinux_state: disabled
         kolla_inspector_dhcp_pool_start: "{{ inspection_net_name | net_inspection_allocation_pool_start }}"
         kolla_inspector_dhcp_pool_end: "{{ inspection_net_name | net_inspection_allocation_pool_end }}"
+        kolla_inspector_netmask: "{{ inspection_net_name | net_mask }}"
         kolla_inspector_default_gateway: "{{ inspection_net_name | net_inspection_gateway or inspection_net_name | net_gateway }}"
         kolla_inspector_extra_kernel_options: "{{ inspector_extra_kernel_options }}"
         kolla_enable_host_ntp: false
diff --git a/ansible/roles/kolla-ansible/defaults/main.yml b/ansible/roles/kolla-ansible/defaults/main.yml
index 541571d378743ddc755406592e28c04e250f35b0..0ef793f5b1344f5bb7098a0d7fcafb97c1927a6d 100644
--- a/ansible/roles/kolla-ansible/defaults/main.yml
+++ b/ansible/roles/kolla-ansible/defaults/main.yml
@@ -170,6 +170,9 @@ kolla_inspector_dhcp_pool_start:
 # End of range of IP addresses for dnsmasq to allocate from.
 kolla_inspector_dhcp_pool_end:
 
+# The inspection network netmask.
+kolla_inspector_netmask:
+
 # Default gateway to use for inspection network.
 kolla_inspector_default_gateway:
 
diff --git a/ansible/roles/kolla-ansible/templates/kolla/globals.yml b/ansible/roles/kolla-ansible/templates/kolla/globals.yml
index f1296f65511ec092d31fc63cc40651189cd6bebf..f5c201ab86f5559602c0812337f94baafa923e7c 100644
--- a/ansible/roles/kolla-ansible/templates/kolla/globals.yml
+++ b/ansible/roles/kolla-ansible/templates/kolla/globals.yml
@@ -391,7 +391,7 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
 # Ironic options
 #############################
 {% if kolla_inspector_dhcp_pool_start and kolla_inspector_dhcp_pool_end %}
-ironic_dnsmasq_dhcp_range: {{ kolla_inspector_dhcp_pool_start }},{{ kolla_inspector_dhcp_pool_end }}
+ironic_dnsmasq_dhcp_range: "{{ kolla_inspector_dhcp_pool_start }},{{ kolla_inspector_dhcp_pool_end }}{% if kolla_inspector_netmask %},{{ kolla_inspector_netmask }}{% endif %}"
 {% endif %}
 {% if kolla_inspector_default_gateway %}
 ironic_dnsmasq_default_gateway: {{ kolla_inspector_default_gateway }}
diff --git a/ansible/roles/kolla-ansible/tests/test-extras.yml b/ansible/roles/kolla-ansible/tests/test-extras.yml
index 522d0cf514f340073f18a4c2a4d00400db6352ca..07f93421135779f63f72a5469e725ee1b038edcd 100644
--- a/ansible/roles/kolla-ansible/tests/test-extras.yml
+++ b/ansible/roles/kolla-ansible/tests/test-extras.yml
@@ -125,6 +125,7 @@
             grafana_local_admin_user_name: "grafana-admin"
             kolla_inspector_dhcp_pool_start: "1.2.3.4"
             kolla_inspector_dhcp_pool_end: "1.2.3.5"
+            kolla_inspector_netmask: "255.255.255.0"
             kolla_inspector_default_gateway: "1.2.3.6"
             # Enable everything.
             kolla_enable_aodh: True
@@ -245,7 +246,7 @@
               kolla_internal_fqdn_cert: "{{ temp_path }}/etc/kolla/certificates/internal.pem"
               openstack_logging_debug: True
               grafana_admin_username: "grafana-admin"
-              ironic_dnsmasq_dhcp_range: "1.2.3.4,1.2.3.5"
+              ironic_dnsmasq_dhcp_range: "1.2.3.4,1.2.3.5,255.255.255.0"
               ironic_dnsmasq_default_gateway: "1.2.3.6"
               # NOTE: The following options are not present in globals.yml.
               # It's possible this is related to the use of hostvars and
diff --git a/releasenotes/notes/inspector-dhcp-range-netmask-bb46eb7df77587a4.yaml b/releasenotes/notes/inspector-dhcp-range-netmask-bb46eb7df77587a4.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..c7cc4cfb5fbeee19adcba476f6d08baf2965a0c9
--- /dev/null
+++ b/releasenotes/notes/inspector-dhcp-range-netmask-bb46eb7df77587a4.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    Adds support for inspection of L3-routed Ironic networks via DHCP-relay.