diff --git a/apps/rego-tunnel/vpn_scripts/start.sh b/apps/rego-tunnel/vpn_scripts/start.sh
index 6ca5551..fa80ffd 100755
--- a/apps/rego-tunnel/vpn_scripts/start.sh
+++ b/apps/rego-tunnel/vpn_scripts/start.sh
@@ -19,8 +19,8 @@ get_windows_ip() {
   local ip=$(awk '/Windows/ {print $3}' /var/lib/misc/dnsmasq.leases 2>/dev/null | head -1)
   if [[ -n "$ip" ]]; then echo "$ip"; return; fi
 
-  # Method 2: ip neigh (ARP table) - look for 172.30.x.x on docker interface
-  ip=$(ip neigh show dev docker 2>/dev/null | grep -oE '172\.30\.[0-9]+\.[0-9]+' | head -1)
+  # Method 2: ip neigh (ARP table) - look for 172.31.x.x on docker interface (VM_NET_IP subnet)
+  ip=$(ip neigh show dev docker 2>/dev/null | grep -oE '172\.31\.[0-9]+\.[0-9]+' | head -1)
   if [[ -n "$ip" ]]; then echo "$ip"; return; fi
 
   # Method 3: qemu.ip file (if available)
@@ -28,8 +28,8 @@ get_windows_ip() {
 }
 
 get_container_ip() {
-  # Get container's external IP on 172.31.x.x subnet (vpn_static-rego)
-  ip -4 addr 2>/dev/null | grep -oE '172\.31\.[0-9]+\.[0-9]+' | head -1
+  # Get container's external IP (172.31.0.10) - exclude docker bridge gateway (.1)
+  ip -4 addr 2>/dev/null | grep -oE '172\.31\.0\.[0-9]+' | grep -v '\.1$' | head -1
 }
 
 (