diff --git a/defaults/meta/network-physical.nix b/defaults/meta/network-physical.nix
index 972476d..69a4057 100644
--- a/defaults/meta/network-physical.nix
+++ b/defaults/meta/network-physical.nix
@@ -43,7 +43,6 @@
       v4 = {
         id = "10.1.1.0";
         prefixLength = 24;
-        # Note: DHCP from .2 to .249, see calanda config
       };
       domain = "plessur-lan.net.qo.is";
 
@@ -51,7 +50,6 @@
         calanda = {
           v4.ip = "10.1.1.1";
         };
-        cyprianspitz.v4.ip = "10.1.1.250";
       };
     };
 
diff --git a/nixos-configurations/calanda/networking.nix b/nixos-configurations/calanda/networking.nix
index 5d3ba48..0f713b9 100644
--- a/nixos-configurations/calanda/networking.nix
+++ b/nixos-configurations/calanda/networking.nix
@@ -4,7 +4,6 @@ let
   meta = config.qois.meta;
   plessur-dmz-net = meta.network.physical.plessur-dmz;
   plessur-lan-net = meta.network.physical.plessur-lan;
-  plessur-ext-net = meta.network.physical.plessur-ext;
   getCalandaIp4 = net: net.hosts.calanda.v4.ip;
 in
 {
@@ -67,19 +66,21 @@ in
   # DMZ Portforwarding
   networking.nat.forwardPorts =
     let
-      cyprianspitzPortDst = (
-        proto: sourcePort: dstPort: {
-          destination = "${plessur-lan-net.hosts.cyprianspitz.v4.ip}:${toString dstPort}";
-          inherit proto;
-          inherit sourcePort;
-          loopbackIPs = [ plessur-ext-net.hosts.calanda.v4.ip ];
+      cyprianspitzPort = (
+        proto: port: {
+          destination = "10.1.1.11:${toString port}";
+          proto = proto;
+          sourcePort = port;
+          loopbackIPs = [ "85.195.200.253" ];
         }
       );
-      cyprianspitzPort = proto: port: (cyprianspitzPortDst proto port port);
     in
     [
-      (cyprianspitzPortDst "tcp" 8222 22)
-      (cyprianspitzPortDst "tcp" 8223 2222)
+      {
+        destination = "10.1.1.11:2222";
+        proto = "tcp";
+        sourcePort = 8223;
+      }
     ]
     ++ map (cyprianspitzPort "tcp") [
       80
diff --git a/nixos-configurations/cyprianspitz/networking.nix b/nixos-configurations/cyprianspitz/networking.nix
index b3b570e..3649afb 100644
--- a/nixos-configurations/cyprianspitz/networking.nix
+++ b/nixos-configurations/cyprianspitz/networking.nix
@@ -2,24 +2,26 @@
 
 let
   meta = config.qois.meta;
-  getNetV4Ip = net: {
-    address = net.hosts.cyprianspitz.v4.ip;
-    prefixLength = net.v4.prefixLength;
-  };
 in
 {
   networking.hostName = meta.hosts.cyprianspitz.hostName;
 
   networking.useDHCP = false;
-  networking.interfaces.enp0s31f6.ipv4.addresses = [
-    (getNetV4Ip meta.network.physical.plessur-lan)
-  ];
+  networking.interfaces.enp0s31f6.useDHCP = true;
   networking.interfaces.enp2s0.useDHCP = true;
 
   # Virtualization
   networking.interfaces.vms-nat.useDHCP = false;
   networking.interfaces.vms-nat.ipv4.addresses = [
-    (getNetV4Ip meta.network.virtual.cyprianspitz-vms-nat)
+    (
+      let
+        netConfig = meta.network.virtual.cyprianspitz-vms-nat;
+      in
+      {
+        address = netConfig.hosts.cyprianspitz.v4.ip;
+        prefixLength = netConfig.v4.prefixLength;
+      }
+    )
   ];
 
   networking.bridges.vms-nat.interfaces = [ ];
diff --git a/nixos-configurations/lindberg/networking.nix b/nixos-configurations/lindberg/networking.nix
index 67f2b0b..35218f7 100644
--- a/nixos-configurations/lindberg/networking.nix
+++ b/nixos-configurations/lindberg/networking.nix
@@ -54,14 +54,7 @@ in
         dhcp-authoritative = true;
       };
     };
-  systemd.services.dnsmasq =
-    let
-      vmsNat = [ "network-addresses-vms-nat.service" ];
-    in
-    {
-      bindsTo = vmsNat;
-      after = vmsNat;
-    };
+  systemd.services.dnsmasq.bindsTo = [ "network-addresses-vms-nat.service" ];
   networking.firewall.interfaces.vms-nat = {
     allowedUDPPorts = [
       53
diff --git a/nixos-modules/qois/loadbalancer/default.nix b/nixos-modules/qois/loadbalancer/default.nix
index fe5477c..56c7208 100644
--- a/nixos-modules/qois/loadbalancer/default.nix
+++ b/nixos-modules/qois/loadbalancer/default.nix
@@ -79,7 +79,7 @@ let
 in
 {
 
-  options.qois.loadbalancer = {
+  options.qois.loadbalancer = with lib; {
     enable = mkEnableOption "Enable services http+s loadbalancing";
 
     domains = mkOption {
diff --git a/nixos-modules/qois/vpn-exit-node/default.nix b/nixos-modules/qois/vpn-exit-node/default.nix
index aff1a84..cc5dc82 100644
--- a/nixos-modules/qois/vpn-exit-node/default.nix
+++ b/nixos-modules/qois/vpn-exit-node/default.nix
@@ -39,7 +39,6 @@ in
         [
           "--timeout 60s"
           "--accept-dns=false"
-          "--accept-routes=false"
           "--login-server=https://${cfg.domain}"
           "--advertise-exit-node"
           "--advertise-routes=${backplaneRoute}"
diff --git a/nixos-modules/qois/vpn-server/default.nix b/nixos-modules/qois/vpn-server/default.nix
index 25ef0a0..0b23fdf 100644
--- a/nixos-modules/qois/vpn-server/default.nix
+++ b/nixos-modules/qois/vpn-server/default.nix
@@ -56,7 +56,6 @@ in
       );
 
     networking.firewall.checkReversePath = "loose";
-    networking.firewall.allowedTCPPorts = [ config.services.headscale.port ];
     networking.firewall.allowedUDPPorts = [
       41641
     ];