diff --git a/apps/rego-tunnel/build/Dockerfile b/apps/rego-tunnel/build/Dockerfile
index 5b6574e..8352fa3 100644
--- a/apps/rego-tunnel/build/Dockerfile
+++ b/apps/rego-tunnel/build/Dockerfile
@@ -2,24 +2,16 @@ FROM ubuntu:24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-RUN apt-get update && apt-get install -y \
-    qemu-system-x86 \
-    qemu-utils \
-    novnc \
-    websockify \
-    openssh-server \
-    supervisor \
-    && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y     qemu-system-x86     qemu-utils     novnc     websockify     openssh-server     supervisor     iproute2     bridge-utils     iptables     net-tools     && rm -rf /var/lib/apt/lists/*
 
 # Setup SSH
-RUN mkdir /var/run/sshd && \
-    echo 'root:vmpassword' | chpasswd && \
-    sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
+RUN mkdir /var/run/sshd &&     echo 'root:vmpassword' | chpasswd &&     sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
 
 WORKDIR /vm
 
 COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 COPY start-vm.sh /usr/local/bin/start-vm.sh
-RUN chmod +x /usr/local/bin/start-vm.sh
+COPY setup-network.sh /usr/local/bin/setup-network.sh
+RUN chmod +x /usr/local/bin/start-vm.sh /usr/local/bin/setup-network.sh
 
 CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]
diff --git a/apps/rego-tunnel/build/setup-network.sh b/apps/rego-tunnel/build/setup-network.sh
new file mode 100644
index 0000000..19e078f
--- /dev/null
+++ b/apps/rego-tunnel/build/setup-network.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+# Setup TAP/Bridge networking for QEMU VM
+# Bridge: 100.100.0.1/24
+# VM will be: 100.100.0.2/24
+
+set -e
+
+# Create bridge if not exists
+if ! ip link show br0 &>/dev/null; then
+    ip link add br0 type bridge
+    ip addr add 100.100.0.1/24 dev br0
+    ip link set br0 up
+    echo "Bridge br0 created with IP 100.100.0.1/24"
+fi
+
+# Create TAP device if not exists
+if ! ip link show tap0 &>/dev/null; then
+    ip tuntap add tap0 mode tap
+    ip link set tap0 master br0
+    ip link set tap0 up
+    echo "TAP device tap0 created and attached to br0"
+fi
+
+# Enable IP forwarding
+echo 1 > /proc/sys/net/ipv4/ip_forward
+
+# Setup NAT/masquerade for outbound traffic from VM
+iptables -t nat -C POSTROUTING -s 100.100.0.0/24 -o eth0 -j MASQUERADE 2>/dev/null ||     iptables -t nat -A POSTROUTING -s 100.100.0.0/24 -o eth0 -j MASQUERADE
+
+# Forward traffic destined for VPN networks to VM (10.35.33.230 = IBM i)
+# The VM will route this through its VPN tunnel
+iptables -C FORWARD -d 10.35.33.230 -j ACCEPT 2>/dev/null ||     iptables -A FORWARD -d 10.35.33.230 -j ACCEPT
+iptables -C FORWARD -s 10.35.33.230 -j ACCEPT 2>/dev/null ||     iptables -A FORWARD -s 10.35.33.230 -j ACCEPT
+
+# Route to IBM i through VM
+ip route add 10.35.33.230 via 100.100.0.2 2>/dev/null || true
+
+echo "Network setup complete"
+echo "Bridge: br0 = 100.100.0.1/24"
+echo "TAP: tap0 attached to br0"
+echo "Route: 10.35.33.230 via 100.100.0.2 (VM)"
diff --git a/apps/rego-tunnel/build/start-vm.sh b/apps/rego-tunnel/build/start-vm.sh
index 24d2922..f670e74 100755
--- a/apps/rego-tunnel/build/start-vm.sh
+++ b/apps/rego-tunnel/build/start-vm.sh
@@ -1,13 +1,5 @@
 #!/bin/bash
-exec qemu-system-x86_64 \
-    -enable-kvm \
-    -cpu host \
-    -m ${VM_RAM:-8G} \
-    -smp ${VM_CPUS:-4} \
-    -hda /vm/linux-vm.qcow2 \
-    -netdev user,id=net0,hostfwd=tcp::2222-:22 \
-    -device virtio-net-pci,netdev=net0 \
-    -vnc :0 \
-    -vga virtio \
-    -usb \
-    -device usb-tablet
+# Wait for network setup
+sleep 2
+
+exec qemu-system-x86_64     -enable-kvm     -cpu host     -m ${VM_RAM:-8G}     -smp ${VM_CPUS:-4}     -hda /vm/linux-vm.qcow2     -netdev tap,id=net0,ifname=tap0,script=no,downscript=no     -device virtio-net-pci,netdev=net0,mac=52:54:00:12:34:56     -vnc :0     -vga virtio     -usb     -device usb-tablet
diff --git a/apps/rego-tunnel/build/supervisord.conf b/apps/rego-tunnel/build/supervisord.conf
index a76b77a..888dfa2 100644
--- a/apps/rego-tunnel/build/supervisord.conf
+++ b/apps/rego-tunnel/build/supervisord.conf
@@ -2,15 +2,28 @@
 nodaemon=true
 logfile=/var/log/supervisord.log
 
+[program:network-setup]
+command=/usr/local/bin/setup-network.sh
+autostart=true
+autorestart=false
+startsecs=0
+priority=1
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
 [program:sshd]
 command=/usr/sbin/sshd -D
 autostart=true
 autorestart=true
+priority=10
 
 [program:qemu]
 command=/usr/local/bin/start-vm.sh
 autostart=true
 autorestart=true
+priority=20
 stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
@@ -20,3 +33,4 @@ stderr_logfile_maxbytes=0
 command=/usr/share/novnc/utils/novnc_proxy --vnc localhost:5900 --listen 6080
 autostart=true
 autorestart=true
+priority=30