diff --git a/installbox.yml b/installbox.yml
index a7418a0..7f64372 100644
--- a/installbox.yml
+++ b/installbox.yml
@@ -16,7 +16,7 @@
     if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first }}"
 
     ## LAN IP address range:
-    ipaddr_lan: 192.168.0.10
+    ipaddr_lan: 192.168.0.10/24
     dhcp_range: 192.168.0.50,192.168.0.150,2h
     dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}"
 
diff --git a/kerberox.yml b/kerberox.yml
index 931652d..d45c1c2 100644
--- a/kerberox.yml
+++ b/kerberox.yml
@@ -15,7 +15,7 @@
     if_lan: "{{ ansible_interfaces | difference([if_wan, 'lo']) | first }}"
 
     ## LAN IP address range:
-    ipaddr_lan: 192.168.0.10
+    ipaddr_lan: 192.168.0.10/24
     dhcp_range: 192.168.0.50,192.168.0.150,2h
     dhcp_list: "{{ lookup('sequence', 'start=50 end=150 format=192.168.0.%d', wantlist=True) }}"
 
diff --git a/roles/krb5-kdc-ldap/tasks/main.yml b/roles/krb5-kdc-ldap/tasks/main.yml
index 104f694..beeb4ac 100644
--- a/roles/krb5-kdc-ldap/tasks/main.yml
+++ b/roles/krb5-kdc-ldap/tasks/main.yml
@@ -176,7 +176,7 @@
 - name: "make 'kerberos' an alias hostname resolvable from the LAN"
   replace:
     path: /etc/hosts
-    regexp: "^({{ ipaddr_lan }}\\s.+)$"
+    regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$"
     replace: '\1	kerberos'
   when: not krb5kdc.stat.exists
 
diff --git a/roles/ldap/tasks/main.yml b/roles/ldap/tasks/main.yml
index b0d4ed4..15e0665 100644
--- a/roles/ldap/tasks/main.yml
+++ b/roles/ldap/tasks/main.yml
@@ -65,7 +65,7 @@
 - name: "make 'ldap' an alias hostname resolvable from the LAN"
   replace:
     path: /etc/hosts
-    regexp: "^({{ ipaddr_lan }}\\s.+)$"
+    regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$"
     replace: '\1	ldap'
   when: not slapd.stat.exists
 
diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml
index 400a49f..845944b 100644
--- a/roles/nfs-server/tasks/main.yml
+++ b/roles/nfs-server/tasks/main.yml
@@ -25,14 +25,14 @@
     dest: /etc/exports
     insertbefore: EOF
     block: |
-      {{ export_root }}         *(sec=krb5p,rw,fsid=0,crossmnt,no_subtree_check)
-      {{ export_root }}/home/   *(sec=krb5p,rw,no_subtree_check)
+      {{ export_root }}         {{ ipaddr_lan | ipaddr('subnet') }}(sec=krb5p,rw,fsid=0,crossmnt,no_subtree_check)
+      {{ export_root }}/home/   {{ ipaddr_lan | ipaddr('subnet') }}(sec=krb5p,rw,no_subtree_check)
   notify: "restart nfs-kernel-server"
 
 - name: "make 'nfs' an alias hostname resolvable from the LAN"
   replace:
     path: /etc/hosts
-    regexp: "^({{ ipaddr_lan }}\\s.+)$"
+    regexp: "^({{ ipaddr_lan | ipaddr('address') }}\\s.+)$"
     replace: '\1	nfs'
   when: not exports.stat.exists
 
diff --git a/roles/tftp-netboot-installer/tasks/main.yml b/roles/tftp-netboot-installer/tasks/main.yml
index a70a711..f6daa83 100644
--- a/roles/tftp-netboot-installer/tasks/main.yml
+++ b/roles/tftp-netboot-installer/tasks/main.yml
@@ -30,4 +30,4 @@
   replace:
     path: /etc/hosts
     regexp: '^(127\.0\.1\.1.*)$'
-    replace: '#\1\n{{ ipaddr_lan }}	{{ ansible_hostname }}.{{ ansible_domain }}	{{ ansible_hostname }}'
+    replace: '#\1\n{{ ipaddr_lan | ipaddr("address") }}	{{ ansible_hostname }}.{{ ansible_domain }}	{{ ansible_hostname }}'
diff --git a/roles/two-interface-firewalld/templates/interfaces-static.j2 b/roles/two-interface-firewalld/templates/interfaces-static.j2
index c9fe71c..9724fa4 100644
--- a/roles/two-interface-firewalld/templates/interfaces-static.j2
+++ b/roles/two-interface-firewalld/templates/interfaces-static.j2
@@ -1,4 +1,4 @@
 auto {{ if_lan }}
 allow-hotplug {{ if_lan }}
 iface {{ if_lan }} inet static
-  address {{ ipaddr_lan }}/24
+  address {{ ipaddr_lan }}
diff --git a/roles/two-interface-shorewall/templates/interfaces-static.j2 b/roles/two-interface-shorewall/templates/interfaces-static.j2
index 6c0fd53..9724fa4 100644
--- a/roles/two-interface-shorewall/templates/interfaces-static.j2
+++ b/roles/two-interface-shorewall/templates/interfaces-static.j2
@@ -2,4 +2,3 @@ auto {{ if_lan }}
 allow-hotplug {{ if_lan }}
 iface {{ if_lan }} inet static
   address {{ ipaddr_lan }}
-  netmask 255.255.255.0