diff --git a/xos/cord/models.py b/xos/cord/models.py
index 26d7d24..67ffdc7 100644
--- a/xos/cord/models.py
+++ b/xos/cord/models.py
@@ -465,7 +465,7 @@
 
     sync_attributes = ("nat_ip", "nat_mac",
                        "lan_ip", "lan_mac",
-                       "wan_ip", "wan_mac",
+                       "wan_ip", "wan_mac", "wan_container_mac",
                        "private_ip", "private_mac",
                        "hpc_client_ip", "hpc_client_mac")
 
@@ -575,6 +575,12 @@
     def wan_mac(self):
         return self.addresses.get("wan", (None, None) )[1]
 
+    # Generate the MAC for the container interface connected to WAN
+    @property
+    def wan_container_mac(self):
+        (a, b, c, d) = self.wan_ip.split('.')
+        return "02:42:%02x:%02x:%02x:%02x" % (int(a), int(b), int(c), int(d))
+
     @property
     def private_ip(self):
         return self.addresses.get("private", (None, None) )[0]
diff --git a/xos/observers/vbng/steps/sync_vbngtenant.py b/xos/observers/vbng/steps/sync_vbngtenant.py
index b603ed6..1347e2f 100644
--- a/xos/observers/vbng/steps/sync_vbngtenant.py
+++ b/xos/observers/vbng/steps/sync_vbngtenant.py
@@ -100,11 +100,11 @@
         if not vcpe.wan_ip:
             self.defer_sync(o, "does not have a WAN IP yet")
 
-        if not vcpe.wan_mac:
-            # this should never happen; WAN MAC is computed from WAN IP
-            self.defer_sync(o, "does not have a WAN MAC yet")
+        if not vcpe.wan_container_mac:
+            # this should never happen; container MAC is computed from WAN IP
+            self.defer_sync(o, "does not have a WAN container MAC yet")
 
-        return (vcpe.wan_ip, vcpe.wan_mac, vcpe.instance.node.name)
+        return (vcpe.wan_ip, vcpe.wan_container_mac, vcpe.instance.node.name)
 
     def sync_record(self, o):
         logger.info("sync'ing VBNGTenant %s" % str(o))
diff --git a/xos/observers/vcpe/steps/sync_vcpetenant.yaml b/xos/observers/vcpe/steps/sync_vcpetenant.yaml
index b485c0f..b5a112a 100644
--- a/xos/observers/vcpe/steps/sync_vcpetenant.yaml
+++ b/xos/observers/vcpe/steps/sync_vcpetenant.yaml
@@ -31,6 +31,8 @@
       lan_mac: {{ lan_mac }}
       wan_ip: {{ wan_ip }}
       wan_mac: {{ wan_mac }}
+      wan_container_mac: {{ wan_container_mac }}
+      wan_next_hop: 10.0.1.253   # FIX ME
       private_ip: {{ private_ip }}
       private_mac: {{ private_mac }}
       hpc_client_ip: {{ hpc_client_ip }}
diff --git a/xos/observers/vcpe/templates/start-vcpe.sh.j2 b/xos/observers/vcpe/templates/start-vcpe.sh.j2
index 7e714de..a3533fa 100755
--- a/xos/observers/vcpe/templates/start-vcpe.sh.j2
+++ b/xos/observers/vcpe/templates/start-vcpe.sh.j2
@@ -5,11 +5,6 @@
     ifconfig|grep $MAC| awk '{print $1}'|grep -v '\.'
 }
 
-function generate_mac_from_ip {
-    IP=$1
-    printf "02:42:%02x:%02x:%02x:%02x\n" `echo $IP|awk -F '.' '{print $1, $2, $3, $4}'`
-}
-
 iptables -L > /dev/null
 ip6tables -L > /dev/null
 
@@ -25,9 +20,8 @@
 fi
 
 # Set up networking via pipework
-WAN_CONTAINER_MAC=$( generate_mac_from_ip {{ wan_ip }} )
 WAN_IFACE=$( mac_to_iface {{ wan_mac }} )
-docker exec $VCPE ifconfig eth0 >> /dev/null || pipework $WAN_IFACE -i eth0 $VCPE {{ wan_ip }}/17@192.168.128.1 $WAN_CONTAINER_MAC
+docker exec $VCPE ifconfig eth0 >> /dev/null || pipework $WAN_IFACE -i eth0 $VCPE {{ wan_ip }}/24@{{ wan_next_hop }} {{ wan_container_mac }}
 
 LAN_IFACE=$( mac_to_iface {{ lan_mac }} )
 docker exec $VCPE ifconfig eth1 >> /dev/null || pipework $LAN_IFACE -i eth1 $VCPE 192.168.0.1/24 @{{ vlan_ids[0] }}