diff --git a/modules/binarylane/main.tf b/modules/binarylane/main.tf
index 6d665f4..ce1d9e4 100644
--- a/modules/binarylane/main.tf
+++ b/modules/binarylane/main.tf
@@ -10,6 +10,17 @@ locals {
     "10.10.12.200/32", # management ssh host
   ]
 
+  # vpc route entries must not overlap the vpcs themselves: the /16 minus 198.18.30.0/23
+  vpc_lab_routes = concat([
+    "198.18.0.0/20",
+    "198.18.16.0/21",
+    "198.18.24.0/22",
+    "198.18.28.0/23",
+    "198.18.32.0/19",
+    "198.18.64.0/18",
+    "198.18.128.0/17",
+  ], [for dst in local.lab_routes : dst if dst != "198.18.0.0/16"])
+
   # ospf hellos over the p2p links; wg has one peer per interface so this routes to it
   ospf_allspf = "224.0.0.5/32"
 
@@ -40,7 +51,7 @@ resource "binarylane_vpc_route_entries" "dmz" {
   for_each = local.vpns
 
   vpc_id = binarylane_vpc.dmz[each.value.region].id
-  route_entries = [for dst in local.lab_routes : {
+  route_entries = [for dst in local.vpc_lab_routes : {
     description = "lab via ${each.key}"
     destination = dst
     router      = binarylane_server.vpn[each.key].private_ipv4_addresses[0]