diff --git a/README.md b/README.md
index cc64429..d6e55db 100644
--- a/README.md
+++ b/README.md
@@ -23,12 +23,11 @@ role in terraform-vault.
 
 ## Mail edge
 
-Each DMZ VPC (`syd` 198.18.30.0/24, `mel` 198.18.31.0/24) holds a postfix edge host and a vpn host. The vpn
+Each DMZ VPC (`syd` 172.18.30.0/24, `mel` 172.18.31.0/24) holds a postfix edge host and a vpn host. The vpn
 host runs wg0 as a /31 point-to-point link to its own prodnxsr0020 interface
 (`wg-syd` on 51821, `wg-mel` on 51822; `router_links` output) and forwards the
 lab routes for its VPC; the edge host reaches the lab through it and has no
-WireGuard. The VPC /24 is connected on both hosts, so it wins over the lab
-198.18.0.0/16 route via the vpn host. Link /31s and vpn loopbacks (dum0) come from 198.18.2.160/27. Lab
+WireGuard. Link /31s and vpn loopbacks (dum0) come from 198.18.2.160/27. Lab
 traffic is sourced from the /31 until Puppet brings up FRR, which peers OSPF
 over wg0 and advertises the loopback and VPC to the router. Router keys live at `kv/service/wireguard/binarylane/prodnxsr0020-<region>`.
 wg0 is bootstrapped from a key in `user_data` (readable via the BinaryLane
diff --git a/modules/binarylane/main.tf b/modules/binarylane/main.tf
index ce1d9e4..ce083e1 100644
--- a/modules/binarylane/main.tf
+++ b/modules/binarylane/main.tf
@@ -10,33 +10,22 @@ locals {
     "10.10.12.200/32", # management ssh host
   ]
 
-  # vpc route entries must not overlap the vpcs themselves: the /16 minus 198.18.30.0/23
-  vpc_lab_routes = concat([
-    "198.18.0.0/20",
-    "198.18.16.0/21",
-    "198.18.24.0/22",
-    "198.18.28.0/23",
-    "198.18.32.0/19",
-    "198.18.64.0/18",
-    "198.18.128.0/17",
-  ], [for dst in local.lab_routes : dst if dst != "198.18.0.0/16"])
-
   # ospf hellos over the p2p links; wg has one peer per interface so this routes to it
   ospf_allspf = "224.0.0.5/32"
 
   vpcs = {
-    syd = "198.18.30.0/24"
-    mel = "198.18.31.0/24"
+    syd = "172.18.30.0/24"
+    mel = "172.18.31.0/24"
   }
 
   vpns = {
-    ausyd2nxvm2131 = { region = "syd", vpc_ip = "198.18.30.11", router_port = 51821, router_address = "198.18.2.176", wg_address = "198.18.2.177", loopback = "198.18.2.161" }
-    aumel1nxvm2133 = { region = "mel", vpc_ip = "198.18.31.11", router_port = 51822, router_address = "198.18.2.178", wg_address = "198.18.2.179", loopback = "198.18.2.162" }
+    ausyd2nxvm2131 = { region = "syd", vpc_ip = "172.18.30.11", router_port = 51821, router_address = "198.18.2.176", wg_address = "198.18.2.177", loopback = "198.18.2.161" }
+    aumel1nxvm2133 = { region = "mel", vpc_ip = "172.18.31.11", router_port = 51822, router_address = "198.18.2.178", wg_address = "198.18.2.179", loopback = "198.18.2.162" }
   }
 
   edges = {
-    ausyd2nxvm2130 = { region = "syd", vpc_ip = "198.18.30.10", vpn = "ausyd2nxvm2131", ptr = "mta1.edge.unkin.net" }
-    aumel1nxvm2132 = { region = "mel", vpc_ip = "198.18.31.10", vpn = "aumel1nxvm2133", ptr = "mta2.edge.unkin.net" }
+    ausyd2nxvm2130 = { region = "syd", vpc_ip = "172.18.30.10", vpn = "ausyd2nxvm2131", ptr = "mta1.edge.unkin.net" }
+    aumel1nxvm2132 = { region = "mel", vpc_ip = "172.18.31.10", vpn = "aumel1nxvm2133", ptr = "mta2.edge.unkin.net" }
   }
 }
 
@@ -51,7 +40,7 @@ resource "binarylane_vpc_route_entries" "dmz" {
   for_each = local.vpns
 
   vpc_id = binarylane_vpc.dmz[each.value.region].id
-  route_entries = [for dst in local.vpc_lab_routes : {
+  route_entries = [for dst in local.lab_routes : {
     description = "lab via ${each.key}"
     destination = dst
     router      = binarylane_server.vpn[each.key].private_ipv4_addresses[0]