diff --git a/nixos/networks/config.nix b/nixos/networks/config.nix
index 37bf6a9..658b6ac 100644
--- a/nixos/networks/config.nix
+++ b/nixos/networks/config.nix
@@ -172,6 +172,10 @@ let
     let
       wanCfg = cfg // { spaceName = spaceName; };
       vethInNSToHost.iface = "vhost";
+      # Temporary peer name, unique per namespace. The peer briefly exists in the
+      # host namespace before being moved; a shared name ("vhost") lets parallel
+      # wan.net.vmix@* starts steal each other's peer ends, cross-wiring namespaces.
+      vethInNSToHost.tempIface = "vh-${wanCfg.spaceName}";
       vethOnHostToNS.iface = "vn-${wanCfg.spaceName}";
       vethOnHostToNS.ipv4.address = calc.cidr.host 1 wanCfg.ipv4.range;
       vethInNSToHost.ipv4.address = calc.cidr.host 2 wanCfg.ipv4.range;
@@ -180,8 +184,9 @@ let
       portForwardRules = lib.concatStringsSep "\n" (lib.mapAttrsToList (hostIPnPort: nsPort: "iptables -t nat -A PREROUTING -p tcp --dport ${hostIPnPort} -j DNAT --to-destination ${vethInNSToHost.ipv4.address}:${toString nsPort}") wanCfg.forwardPorts);
 
       createWanCommands = ''
-        ip link add ${vethOnHostToNS.iface} type veth peer name ${vethInNSToHost.iface}
-        ip link set ${vethInNSToHost.iface} netns ${wanCfg.spaceName}.vmix
+        ip link add ${vethOnHostToNS.iface} type veth peer name ${vethInNSToHost.tempIface}
+        ip link set ${vethInNSToHost.tempIface} netns ${wanCfg.spaceName}.vmix
+        ip netns exec ${wanCfg.spaceName}.vmix ip link set ${vethInNSToHost.tempIface} name ${vethInNSToHost.iface}
 
         ip address add ${vethOnHostToNS.ipv4.address}/${networkPrefix} dev ${vethOnHostToNS.iface}
         ip netns exec ${wanCfg.spaceName}.vmix ip address add ${vethInNSToHost.ipv4.address}/${networkPrefix} dev ${vethInNSToHost.iface}