diff --git a/ipam/allocator.go b/ipam/allocator.go
index 71fad920..0eef318d 100644
--- a/ipam/allocator.go
+++ b/ipam/allocator.go
@@ -182,7 +182,10 @@ func (alloc *Allocator) SetDefaultSubnet(subnet address.CIDR) error {
 		return fmt.Errorf("Allocation range smaller than minimum size 4: %s", subnet)
 	}
 	alloc.actionChan <- func() {
-		// todo: check default subnet is in range
+		if !alloc.universe.Overlaps(subnet) {
+			resultChan <- fmt.Errorf("Default subnet %s out of bounds: %s", subnet, alloc.universe)
+			return
+		}
 		alloc.defaultSubnet = subnet
 		resultChan <- nil
 	}
diff --git a/ipam/http.go b/ipam/http.go
index 13889cf1..e174505e 100644
--- a/ipam/http.go
+++ b/ipam/http.go
@@ -67,11 +67,15 @@ func (alloc *Allocator) HandleHTTP(router *mux.Router) {
 		vars := mux.Vars(r)
 		ident := vars["id"]
 		cidrStr := vars["ip"] + "/" + vars["prefixlen"]
-		_, cidr, err := address.ParseCIDR(cidrStr)
+		subnetAddr, cidr, err := address.ParseCIDR(cidrStr)
 		if err != nil {
 			badRequest(w, err)
 			return
 		}
+		if cidr.Start != subnetAddr {
+			badRequest(w, fmt.Errorf("Invalid subnet %s - bits after network prefix are not all zero", cidrStr))
+			return
+		}
 		addr, err := alloc.Allocate(ident, cidr, closedChan)
 		if err != nil {
 			badRequest(w, fmt.Errorf("Unable to allocate: %s", err))