diff --git a/Dockers/pia-wireguard/entrypoint.sh b/Dockers/pia-wireguard/entrypoint.sh
index 9db8e3c..6b2a272 100644
--- a/Dockers/pia-wireguard/entrypoint.sh
+++ b/Dockers/pia-wireguard/entrypoint.sh
@@ -14,7 +14,9 @@ PIA_DNS_PRE_VPN="${PIA_DNS_PRE_VPN:-1.1.1.1}"
 PIA_HEALTH_URL="${PIA_HEALTH_URL:-https://api64.ipify.org}"
 PIA_HANDSHAKE_MAX_AGE_SECONDS="${PIA_HANDSHAKE_MAX_AGE_SECONDS:-180}"
 PIA_RECONNECT_BACKOFF_SECONDS="${PIA_RECONNECT_BACKOFF_SECONDS:-5}"
-PIA_LOCAL_NETS="${PIA_LOCAL_NETS:-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"
+# Networks that must stay reachable via the original (non-VPN) default gateway.
+# NOTE: Do not include PIA's internal 10.x gateways here (PF uses server_vip ~ 10.x.x.1).
+PIA_LOCAL_NETS="${PIA_LOCAL_NETS:-172.16.0.0/12,192.168.0.0/16}"
 
 CA_CERT_PATH="/opt/pia/ca.rsa.4096.crt"
 
@@ -150,9 +152,10 @@ is_tunnel_healthy() {
 
 start_port_forwarding_loop() {
   local token="$1"
-  local wg_ip="$2"
+  local pf_gateway="$2"
   local wg_cn="$3"
   local region="$4"
+  local wg_ip="$5"
 
   (
     set -euo pipefail
@@ -160,7 +163,7 @@ start_port_forwarding_loop() {
     local sigresp status payload signature port expires_at bindresp
 
     while true; do
-      sigresp="$(pia_pf_get_signature "$wg_ip" "$wg_cn" "$token" "$CA_CERT_PATH")"
+      sigresp="$(pia_pf_get_signature "$pf_gateway" "$wg_cn" "$token" "$CA_CERT_PATH")"
       status="$(jq -r '.status' <<<"$sigresp")"
       if [[ "$status" != "OK" ]]; then
         >&2 echo "PF getSignature did not return OK: $sigresp"
@@ -173,7 +176,7 @@ start_port_forwarding_loop() {
       port="$(echo "$payload" | base64 -d | jq -r '.port')"
       expires_at="$(echo "$payload" | base64 -d | jq -r '.expires_at')"
 
-      bindresp="$(pia_pf_bind_port "$wg_ip" "$wg_cn" "$payload" "$signature" "$CA_CERT_PATH")"
+      bindresp="$(pia_pf_bind_port "$pf_gateway" "$wg_cn" "$payload" "$signature" "$CA_CERT_PATH")"
       if [[ "$(jq -r '.status' <<<"$bindresp")" != "OK" ]]; then
         >&2 echo "PF bindPort did not return OK: $bindresp"
         sleep 10
@@ -183,12 +186,13 @@ start_port_forwarding_loop() {
       ensure_state_dir
       jq -n \
         --arg region "$region" \
+        --arg pf_gateway "$pf_gateway" \
         --arg server_ip "$wg_ip" \
         --arg server_cn "$wg_cn" \
         --argjson port "$port" \
         --arg expires_at "$expires_at" \
         --arg refreshed_at "$(date -Is)" \
-        '{region:$region,server:{ip:$server_ip,cn:$server_cn},port:$port,expires_at:$expires_at,refreshed_at:$refreshed_at}' \
+        '{region:$region,server:{ip:$server_ip,cn:$server_cn,pf_gateway:$pf_gateway},port:$port,expires_at:$expires_at,refreshed_at:$refreshed_at}' \
         > "$PIA_PF_FILE.tmp" \
         && mv "$PIA_PF_FILE.tmp" "$PIA_PF_FILE"
 
@@ -210,7 +214,7 @@ connect_region() {
 
   log "Connecting region=$region wg=${wg_cn} (${wg_ip})"
 
-  local privKey pubKey wgjson status peer_ip server_key server_port dns_server
+  local privKey pubKey wgjson status peer_ip server_key server_port dns_server pf_gateway
   privKey="$(wg genkey)"
   pubKey="$(echo "$privKey" | wg pubkey)"
 
@@ -225,6 +229,7 @@ connect_region() {
   server_key="$(jq -r '.server_key' <<<"$wgjson")"
   server_port="$(jq -r '.server_port' <<<"$wgjson")"
   dns_server="$(jq -r '.dns_servers[0] // empty' <<<"$wgjson")"
+  pf_gateway="$(jq -r '.server_vip // .server_ip // empty' <<<"$wgjson")"
   if [[ -z "$dns_server" ]]; then
     dns_server="$PIA_DNS_FALLBACK"
   fi
@@ -252,7 +257,11 @@ connect_region() {
   echo
 
   if [[ "$PIA_PF_ENABLED" == "true" ]]; then
-    start_port_forwarding_loop "$token" "$wg_ip" "$wg_cn" "$region"
+    if [[ -z "$pf_gateway" ]]; then
+      >&2 echo "Port forwarding enabled but no server_vip/server_ip found in addKey response."
+    else
+      start_port_forwarding_loop "$token" "$pf_gateway" "$wg_cn" "$region" "$wg_ip"
+    fi
   fi
 }