diff --git a/lib/MirrorCache/Datamodule.pm b/lib/MirrorCache/Datamodule.pm
index c74ddb32..30405d15 100644
--- a/lib/MirrorCache/Datamodule.pm
+++ b/lib/MirrorCache/Datamodule.pm
@@ -1,4 +1,4 @@
-# Copyright (C) 2021-2024 SUSE LLC
+# Copyright (C) 2021-2025 SUSE LLC
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -64,6 +64,7 @@ has root_subtree => ($ENV{MIRRORCACHE_SUBTREE} // "");
 
 has _vpn_var => $ENV{MIRRORCACHE_VPN};
 has vpn_prefix => ($ENV{MIRRORCACHE_VPN_PREFIX} ? lc($ENV{MIRRORCACHE_VPN_PREFIX}) : "10.");
+has vpn_prefix_neg => ($ENV{MIRRORCACHE_VPN_PREFIX_NEG} ? lc($ENV{MIRRORCACHE_VPN_PREFIX_NEG}) : "");
 
 has 'at';
 has '_mime';
@@ -139,6 +140,11 @@ sub vpn($self) {
             for my $pref (split /[\s]+/, $self->vpn_prefix) {
                 $match = 1 if (rindex($ip, $pref, 0) == 0);
             }
+            if ($match && $self->vpn_prefix_neg) {
+                for my $pref (split /[\s]+/, $self->vpn_prefix_neg) {
+                    $match = 0 if (rindex($ip, $pref, 0) == 0);
+                }
+            } 
             $self->_vpn($match);
         }
     }
diff --git a/t/environ/15-local-symlink-subtree-rootredirect.sh b/t/environ/15-local-symlink-subtree-rootredirect.sh
index aea15b39..fe4fc2f5 100755
--- a/t/environ/15-local-symlink-subtree-rootredirect.sh
+++ b/t/environ/15-local-symlink-subtree-rootredirect.sh
@@ -45,6 +45,7 @@ $mcsub/gen_env MIRRORCACHE_ROOT="'$mc/dt:testhost.com:testhost.vpn'" \
                MIRRORCACHE_SUBTREE=/updates \
                MIRRORCACHE_TOP_FOLDERS=tool \
                MIRRORCACHE_VPN_PREFIX='"11. 10.10"' \
+               MIRRORCACHE_VPN_PREFIX_NEG='"10.10.99"' \
                MIRRORCACHE_ROOT_COUNTRY=us
 
 $mcsub/start
@@ -64,9 +65,9 @@ $mcsub/curl /tool/v2/file1.1.dat.metalink   | grep -C10 $($ap8/print_address)/up
 $mcsub/curl /tool/v1/file1.1.dat.mirrorlist | grep -C30 $($ap7/print_address)/folder1/file1.1.dat | grep -C30 $($ap8/print_address)/updates/tool/v1/file1.1.dat | grep testhost.com/folder1/file1.1.dat
 $mcsub/curl /tool/v2/file1.1.dat.mirrorlist | grep -C30 $($ap8/print_address)/updates/tool/v2/file1.1.dat | grep testhost.com/folder2/file1.1.dat
 
-$mcsub/curl /tool/v1/file1.1.dat.metalink?IP=10.11.10.1  | grep testhost
+$mcsub/curl /tool/v1/file1.1.dat.metalink?IP=10.10.99.1  | grep testhost.com
 $mcsub/curl /tool/v1/file1.1.dat.metalink?IP=10.11.10.1  | grep testhost.com
-$mcsub/curl /tool/v1/file1.1.dat.metalink?IP=10.10.10.1  | grep testhost
+$mcsub/curl /tool/v1/file1.1.dat.metalink?IP=10.10.10.1  | grep testhost.vpn
 rc=0
 $mcsub/curl /tool/v1/file1.1.dat.metalink?IP=10.10.10.1  | grep testhost.com || rc=$?
 test $rc -gt 0