diff --git a/apps/rego-tunnel/vpn_scripts/start.sh b/apps/rego-tunnel/vpn_scripts/start.sh
index c3d26b8..4ed50b3 100755
--- a/apps/rego-tunnel/vpn_scripts/start.sh
+++ b/apps/rego-tunnel/vpn_scripts/start.sh
@@ -19,8 +19,8 @@ get_windows_ip() {
   local ip=$(awk '/Windows/ {print $3}' /var/lib/misc/dnsmasq.leases 2>/dev/null | head -1)
   if [[ -n "$ip" ]]; then echo "$ip"; return; fi
 
-  # Method 2: ip neigh (ARP table) - look for 172.30.x.x on docker interface
-  ip=$(ip neigh show dev docker 2>/dev/null | grep -oE '172\.30\.[0-9]+\.[0-9]+' | head -1)
+  # Method 2: ip neigh (ARP table) - look for 172.32.x.x on docker interface (VM_NET_IP subnet)
+  ip=$(ip neigh show dev docker 2>/dev/null | grep -oE '172\.32\.[0-9]+\.[0-9]+' | head -1)
   if [[ -n "$ip" ]]; then echo "$ip"; return; fi
 
   # Method 3: qemu.ip file (if available)