diff --git a/config/fail2ban/ignoreip.conf b/config/fail2ban/ignoreip.conf
index 647e7bb..6bcb09c 100644
--- a/config/fail2ban/ignoreip.conf
+++ b/config/fail2ban/ignoreip.conf
@@ -1,6 +1,7 @@
 # Host-originated connections reach postfix/dovecot via the docker bridge
 # gateway. Without ignoring it, the postfix jail bans our own host as
 # collateral of port-25 scanner noise + local TLS probes (self-DoS: host
-# submission times out). Keep in sync with the compose network subnet.
+# submission times out). Keep in sync with the compose network subnet
+# (`docker network inspect mail-server_default`: 192.168.32.0/20, gw .32.1).
 [DEFAULT]
-ignoreip = 127.0.0.1/8 192.168.32.0/24 192.168.1.0/24
+ignoreip = 127.0.0.1/8 192.168.32.0/20 192.168.1.0/24