diff --git a/release-notes.md b/release-notes.md
index 7ca4f7e6..053bcfb3 100644
--- a/release-notes.md
+++ b/release-notes.md
@@ -8,6 +8,8 @@
 
 ## Bugs fixed:
 * Fixed a bug from the CSDK handling hosted services
+* [#330](https://github.com/openziti/desktop-edge-win/issues/330) Fixed issue intercepting connections when the configured IP is not exactly in 100.64.0.0/10
+* [#328](https://github.com/openziti/desktop-edge-win/issues/328) Print a warning when the configured IP is not in the carrier grade NAT range 100.64.0.0/10
 
 ## Dependency Updates
 * Tunneler SDK to v0.11.10/CSDK 0.20.22
diff --git a/service/cziti/ctun.go b/service/cziti/ctun.go
index c07e570d..85105a57 100644
--- a/service/cziti/ctun.go
+++ b/service/cziti/ctun.go
@@ -52,6 +52,7 @@ dns_manager* dns_mgr_c;
 int netifAddRoute(netif_handle dev, char* dest);
 int netifRemoveRoute(netif_handle dev, char* dest);
 
+
 */
 import "C"
 import (
@@ -134,11 +135,6 @@ func makeDriver(name string) C.netif_driver {
 
 //export netifWrite
 func netifWrite(_ C.netif_handle, buf unsafe.Pointer, length C.size_t) C.ssize_t {
-	/*t, found := devMap[C.GoString(h.id)]
-	if !found {
-		log.Panicf("An unexpected and unrecoverable error has occurred while calling netifWrite")
-	}*/
-
 	b := C.GoBytes(buf, C.int(length))
 
 	theTun.writeQ <- b
diff --git a/service/cziti/sdk.go b/service/cziti/sdk.go
index 5e2ae32e..a690e47f 100644
--- a/service/cziti/sdk.go
+++ b/service/cziti/sdk.go
@@ -623,3 +623,7 @@ func getTunneledServiceAddresses(ts *C.tunneled_service_t) []dto.Address {
 	}
 	return values
 }
+
+func InitTunnelerDns(ipBase uint32, mask int) {
+	C.ziti_tunneler_init_dns(C.uint32_t(ipBase), C.int(mask))
+}
diff --git a/service/cziti/sdk.h b/service/cziti/sdk.h
index 18844da4..553267c7 100644
--- a/service/cziti/sdk.h
+++ b/service/cziti/sdk.h
@@ -85,5 +85,6 @@ void ziti_dump_go(char *msg);
 //void ziti_mfa_auth_request(ziti_ar_mfa_cb response_cb, ziti_context ztx, void *mfa_ctx, char *code, ziti_ar_mfa_status_cb auth_response, char *fingerprint);
 //void ziti_mfa_ar_cb(ziti_context ztx, void *mfa_ctx, int status);
 //void ziti_ar_mfa_status_cb_go(ziti_context ztx, void *mfa_ctx, int status, char *fingerprint);
+int dnsFallback(const char *name, void *ctx, struct in_addr* addr);
 
 #endif /* GOLANG_SDK_H */
diff --git a/service/ziti-tunnel/service/ipc.go b/service/ziti-tunnel/service/ipc.go
index 1f55d1ee..bff3a0a5 100644
--- a/service/ziti-tunnel/service/ipc.go
+++ b/service/ziti-tunnel/service/ipc.go
@@ -20,6 +20,7 @@ package service
 import (
 	"bufio"
 	"crypto/sha1"
+	"encoding/binary"
 	"encoding/json"
 	"fmt"
 	"github.com/Microsoft/go-winio"
@@ -260,6 +261,27 @@ func (p *Pipes) shutdownConnections() {
 }
 
 func initialize(cLogLevel int) error {
+	//TODO: this all needs to be cleaned up. it's done it two places and redundant
+	//TODO: fix with mfa?
+	ipv4 := rts.state.TunIpv4
+	ipv4mask := rts.state.TunIpv4Mask
+	if strings.TrimSpace(ipv4) == "" {
+		log.Infof("ip not provided using default: %v", ipv4)
+		ipv4 = constants.Ipv4ip
+		rts.UpdateIpv4(ipv4)
+	}
+	if ipv4mask < constants.Ipv4MaxMask {
+		log.Warnf("provided mask is too large: %d using default: %d", ipv4mask, constants.Ipv4DefaultMask)
+		ipv4mask = constants.Ipv4DefaultMask
+		rts.UpdateIpv4Mask(ipv4mask)
+	}
+	_, ipnet, err := net.ParseCIDR(fmt.Sprintf("%s/%d", ipv4, ipv4mask))
+	if err != nil {
+		return fmt.Errorf("error parsing CIDR block: (%v)", err)
+	}
+	dnsIpAsUint32 := binary.BigEndian.Uint32(ipnet.IP)
+	cziti.InitTunnelerDns(dnsIpAsUint32, len(ipnet.Mask))
+
 	assignedIp, t, err := rts.CreateTun(rts.state.TunIpv4, rts.state.TunIpv4Mask)
 	if err != nil {
 		return err
@@ -312,6 +334,16 @@ func setTunInfo(s *dto.TunnelStatus) {
 		return
 	}
 
+	carrierGradeNetworkRange := fmt.Sprintf("%s/%d", constants.Ipv4ip, 10)
+	_, cgsubnet, _ := net.ParseCIDR(carrierGradeNetworkRange)
+
+	if !cgsubnet.Contains(ipnet.IP) {
+		log.Warnf("============================================================================")
+		log.Warnf("the ip provided [%s] is NOT in the expected CIDR range of %s", ipv4, carrierGradeNetworkRange)
+		log.Warnf("this can cause unintented consequences. Please update the ip to one in the specified range.")
+		log.Warnf("============================================================================")
+	}
+
 	t := *rts.tun
 	mtu, err := t.MTU()
 	if err != nil {