diff --git a/site/features.md b/site/features.md
index 1d89b26c..906a9152 100644
--- a/site/features.md
+++ b/site/features.md
@@ -184,6 +184,12 @@ will work. And, more interestingly,
 
 will work too, which is talking to a container that resides on `$HOST1`.
 
+Multiple subnet addresses can be exposed or hidden with a single
+invocation:
+
+    host2# weave expose 10.2.1.102/24 10.3.1.102/24
+    host2# weave hide 10.2.1.102/24 10.3.1.102/24
+
 ### <a name="service-export"></a>Service export
 
 Services running in containers on a weave network can be made
diff --git a/test/500_weave_multi_cidr_test.sh b/test/500_weave_multi_cidr_test.sh
index dbd42da9..c280127a 100755
--- a/test/500_weave_multi_cidr_test.sh
+++ b/test/500_weave_multi_cidr_test.sh
@@ -51,6 +51,17 @@ assert_zone_records() {
     done
 }
 
+# assert_bridge_cidrs <host> <dev> <cidr> [<cidr> ...]
+assert_bridge_cidrs() {
+    HOST=$1; shift
+    DEV=$1; shift
+    CIDRS=$@
+
+    BRIDGE_CIDRS=$($SSH $HOST ip addr show dev $DEV | grep -o 'inet .*' | cut -d ' ' -f 2)
+
+    assert "echo $BRIDGE_CIDRS" "$CIDRS"
+}
+
 # Run container with three cidrs
 CID=$(DOCKER_HOST=tcp://$HOST1:2375 $WEAVE run 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 -t --name multicidr -h multicidr.weave.local ubuntu | cut -b 1-12)
 assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24
@@ -72,4 +83,12 @@ weave_on $HOST1 start 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 $CID
 assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24
 assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3
 
+# Expose some cidrs
+weave_on $HOST1 expose 10.0.0.4/24 10.0.0.5/24 10.0.0.6/24
+assert_bridge_cidrs $HOST1 weave 10.0.0.4/24 10.0.0.5/24 10.0.0.6/24
+
+# Hide some cidrs
+weave_on $HOST1 hide 10.0.0.5/24 10.0.0.6/24
+assert_bridge_cidrs $HOST1 weave 10.0.0.4/24
+
 end_suite
\ No newline at end of file
diff --git a/weave b/weave
index b3d2c4ff..fbaed1ad 100755
--- a/weave
+++ b/weave
@@ -715,29 +715,31 @@ case "$COMMAND" in
         tell_dns DELETE $CONTAINER_ID $CIDR_ARGS
         ;;
     expose)
-        [ $# -eq 1 ] || usage
-        CIDR=$1
-        validate_cidr $CIDR
-        create_bridge --without-ethtool
-        if ! ip addr show dev $BRIDGE | grep -qF $CIDR
-        then
-            ip addr add dev $BRIDGE $CIDR
-            arp_update $BRIDGE $CIDR
-            add_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE
-            add_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE
-        fi
+        [ $# -gt 0 ] || usage
+        for CIDR; do
+            validate_cidr $CIDR
+            create_bridge --without-ethtool
+            if ! ip addr show dev $BRIDGE | grep -qF $CIDR
+            then
+                ip addr add dev $BRIDGE $CIDR
+                arp_update $BRIDGE $CIDR
+                add_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE
+                add_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE
+            fi
+        done
         ;;
     hide)
-        [ $# -eq 1 ] || usage
-        CIDR=$1
-        validate_cidr $CIDR
-        create_bridge --without-ethtool
-        if ip addr show dev $BRIDGE | grep -qF $CIDR
-        then
-            ip addr del dev $BRIDGE $CIDR
-            delete_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE
-            delete_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE
-        fi
+        [ $# -gt 0 ] || usage
+        for CIDR; do
+            validate_cidr $CIDR
+            create_bridge --without-ethtool
+            if ip addr show dev $BRIDGE | grep -qF $CIDR
+            then
+                ip addr del dev $BRIDGE $CIDR
+                delete_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE
+                delete_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE
+            fi
+        done
         ;;
     stop)
         [ $# -eq 0 ] || usage