diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 867f1bd34..d2c3000d6 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -449,8 +449,6 @@ with import <stockholm/lib>;
         retiolum = rec {
           via = internet;
           addrs = [
-            # edinburgh university
-            "129.215.0.0/16"
             ip4.addr
             ip6.addr
           ];
@@ -472,6 +470,10 @@ with import <stockholm/lib>;
             lyK301Jb42wGEsVWxu3Eo/PLtp8OdD+Wdh6o/ELcc0k/YCUGFMujUM8CAwEAAQ==
             -----END RSA PUBLIC KEY-----
           '';
+          tinc.subnets = [
+            # edinburgh university
+            "129.215.0.0/16"
+          ];
         };
       };
     };
diff --git a/lib/types.nix b/lib/types.nix
index 08dc0974e..c3b14d807 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -92,7 +92,7 @@ rec {
         default = null;
       };
       addrs = mkOption {
-        type = listOf cidr;
+        type = listOf addr;
         default =
           optional (config.ip4 != null) config.ip4.addr ++
           optional (config.ip6 != null) config.ip6.addr;
@@ -155,6 +155,8 @@ rec {
                 ++
                 (map (a: "Subnet = ${a}") net.addrs)
                 ++
+                (map (a: "Subnet = ${a}") config.subnets)
+                ++
                 [config.extraConfig]
                 ++
                 [config.pubkey]
@@ -173,6 +175,11 @@ rec {
               description = "tinc port to use to connect to host";
               default = 655;
             };
+            subnets = mkOption {
+              type = listOf cidr;
+              description = "tinc subnets";
+              default = [];
+            };
           };
         }));
         default = null;