diff --git a/apps/rego-tunnel/build/setup-network.sh b/apps/rego-tunnel/build/setup-network.sh
index 63185e4..3c601b7 100755
--- a/apps/rego-tunnel/build/setup-network.sh
+++ b/apps/rego-tunnel/build/setup-network.sh
@@ -11,9 +11,9 @@ set -e
 
 BRIDGE_NAME="${BRIDGE_NAME:-br-rego-vpn}"
 TAP_NAME="${TAP_NAME:-tap0}"
-BRIDGE_CIDR="${BRIDGE_CIDR:-100.100.0.1/24}"
+BRIDGE_CIDR="${BRIDGE_CIDR:-100.100.0.1}/24"
 VM_NET_IP="${VM_NET_IP:-100.100.0.2}"
-VM_SUBNET="${VM_SUBNET:-100.100.0.0/24}"
+VM_SUBNET="${VM_SUBNET:-100.100.0.0}/24"
 TARGET_IP="${TARGET_IP:-10.35.33.230}"
 
 # Pick the outbound interface based on the container's default route.
diff --git a/apps/rego-tunnel/build/start-dnsmasq.sh b/apps/rego-tunnel/build/start-dnsmasq.sh
index 9227fd8..dba4a17 100644
--- a/apps/rego-tunnel/build/start-dnsmasq.sh
+++ b/apps/rego-tunnel/build/start-dnsmasq.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 BRIDGE_NAME="${BRIDGE_NAME:-br-rego-vpn}"
-BRIDGE_CIDR="${BRIDGE_CIDR:-100.100.0.1/24}"
+BRIDGE_CIDR="${BRIDGE_CIDR:-100.100.0.1}/24"
 VM_NET_IP="${VM_NET_IP:-100.100.0.2}"
 VM_MAC="${VM_MAC:-52:54:00:12:34:56}"
 
diff --git a/apps/rego-tunnel/config.json b/apps/rego-tunnel/config.json
index 9374a2a..3567d04 100755
--- a/apps/rego-tunnel/config.json
+++ b/apps/rego-tunnel/config.json
@@ -71,19 +71,19 @@
       "type": "ip",
       "label": "Bridge CIDR",
       "hint": "Bridge address/CIDR assigned inside the container",
-      "placeholder": "100.100.0.1/24",
+      "placeholder": "100.100.0.1",
       "required": true,
       "env_variable": "BRIDGE_CIDR",
-      "default": "100.100.0.1/24"
+      "default": "100.100.0.1"
     },
     {
       "type": "ip",
       "label": "VM subnet",
       "hint": "Subnet that should be NATed out of the container",
-      "placeholder": "100.100.0.0/24",
+      "placeholder": "100.100.0.0",
       "required": true,
       "env_variable": "VM_SUBNET",
-      "default": "100.100.0.0/24"
+      "default": "100.100.0.0"
     },
     {
       "type": "ip",