diff --git a/srsepc/hdr/spgw/spgw.h b/srsepc/hdr/spgw/spgw.h
index 9612b18a63..a7c9b2efde 100644
--- a/srsepc/hdr/spgw/spgw.h
+++ b/srsepc/hdr/spgw/spgw.h
@@ -45,6 +45,7 @@ typedef struct {
   std::string gtpu_bind_addr;
   std::string sgi_if_addr;
   std::string sgi_if_name;
+  std::string sgi_if_netmask;
   uint32_t    max_paging_queue;
 } spgw_args_t;
 
diff --git a/srsepc/src/main.cc b/srsepc/src/main.cc
index 88bac0665f..4407091b33 100644
--- a/srsepc/src/main.cc
+++ b/srsepc/src/main.cc
@@ -90,6 +90,7 @@ void parse_args(all_args_t* args, int argc, char* argv[])
   string   spgw_bind_addr;
   string   sgi_if_addr;
   string   sgi_if_name;
+  string   sgi_if_netmask;
   string   dns_addr;
   string   full_net_name;
   string   short_net_name;
@@ -130,6 +131,7 @@ void parse_args(all_args_t* args, int argc, char* argv[])
     ("spgw.gtpu_bind_addr", bpo::value<string>(&spgw_bind_addr)->default_value("127.0.0.1"), "IP address of SP-GW for the S1-U connection")
     ("spgw.sgi_if_addr",    bpo::value<string>(&sgi_if_addr)->default_value("176.16.0.1"),   "IP address of TUN interface for the SGi connection")
     ("spgw.sgi_if_name",    bpo::value<string>(&sgi_if_name)->default_value("srs_spgw_sgi"), "Name of TUN interface for the SGi connection")
+    ("spgw.sgi_if_netmask", bpo::value<string>(&sgi_if_netmask)->default_value("255.255.255.0"),  "IP mask of TUN interface for the SGi connection")
     ("spgw.max_paging_queue", bpo::value<uint32_t>(&max_paging_queue)->default_value(100), "Max number of packets in paging queue")
 
     ("pcap.enable",   bpo::value<bool>(&args->mme_args.s1ap_args.pcap_enable)->default_value(false),         "Enable S1AP PCAP")
@@ -294,6 +296,7 @@ void parse_args(all_args_t* args, int argc, char* argv[])
   args->spgw_args.gtpu_bind_addr          = spgw_bind_addr;
   args->spgw_args.sgi_if_addr             = sgi_if_addr;
   args->spgw_args.sgi_if_name             = sgi_if_name;
+  args->spgw_args.sgi_if_netmask          = sgi_if_netmask;
   args->spgw_args.max_paging_queue        = max_paging_queue;
   args->hss_args.db_file                  = hss_db_file;
 
diff --git a/srsepc/src/spgw/gtpc.cc b/srsepc/src/spgw/gtpc.cc
index 0c041cf37c..ad35ee8e59 100644
--- a/srsepc/src/spgw/gtpc.cc
+++ b/srsepc/src/spgw/gtpc.cc
@@ -561,9 +561,17 @@ int spgw::gtpc::init_ue_ip(spgw_args_t* args, const std::map<std::string, uint64
     }
   }
 
-  // XXX TODO add an upper bound to ip addr range via config, use 254 for now
+  struct in_addr netmask_addr;
+  if (inet_pton(AF_INET, args->sgi_if_netmask.c_str(), &netmask_addr.s_addr) != 1) {
+    m_logger.error("Invalid sgi_if_netmask: %s", args->sgi_if_netmask.c_str());
+    srsran::console("Invalid sgi_if_netmask: %s\n", args->sgi_if_netmask.c_str());
+    perror("inet_pton");
+    return SRSRAN_ERROR;
+  }
+  uint32_t hosts_bound = (~ntohl(netmask_addr.s_addr)) - 1;
+
   // first address is allocated to the epc tun interface, start w/next addr
-  for (uint32_t n = 1; n < 254; ++n) {
+  for (uint32_t n = 1; n < hosts_bound; ++n) {
     struct in_addr ue_addr;
     if (inet_pton(AF_INET, args->sgi_if_addr.c_str(), &ue_addr.s_addr) != 1) {
       m_logger.error("Invalid sgi_if_addr: %s", args->sgi_if_addr.c_str());
@@ -571,7 +579,7 @@ int spgw::gtpc::init_ue_ip(spgw_args_t* args, const std::map<std::string, uint64
       perror("inet_pton");
       return SRSRAN_ERROR;
     }
-    ue_addr.s_addr = ue_addr.s_addr + htonl(n);
+    ue_addr.s_addr = htonl(ntohl(ue_addr.s_addr) + n);
 
     std::map<std::string, uint64_t>::const_iterator iter = ip_to_imsi.find(inet_ntoa(ue_addr));
     if (iter != ip_to_imsi.end()) {
diff --git a/srsepc/src/spgw/gtpu.cc b/srsepc/src/spgw/gtpu.cc
index 59bd7ca4d4..3d93eae36b 100644
--- a/srsepc/src/spgw/gtpu.cc
+++ b/srsepc/src/spgw/gtpu.cc
@@ -156,7 +156,7 @@ int spgw::gtpu::init_sgi(spgw_args_t* args)
   }
 
   ifr.ifr_netmask.sa_family = AF_INET;
-  if (inet_pton(ifr.ifr_netmask.sa_family , "255.255.255.0", &((struct sockaddr_in*)&ifr.ifr_netmask)->sin_addr.s_addr) != 1) {
+  if (inet_pton(ifr.ifr_netmask.sa_family , args->sgi_if_netmask.c_str(), &((struct sockaddr_in*)&ifr.ifr_netmask)->sin_addr.s_addr) != 1) {
     perror("inet_pton");
     return false;
   }