diff --git a/.forgejo/workflows/prerelease.yml b/.forgejo/workflows/prerelease.yml
index 2440fbd..ed635e9 100644
--- a/.forgejo/workflows/prerelease.yml
+++ b/.forgejo/workflows/prerelease.yml
@@ -37,6 +37,8 @@ jobs:
           - metadata
           - metacli
           - agent
+          - dhcp
+          - subnet
     uses: ./.forgejo/workflows/build.yml
     with:
       tag: ${{ needs.set-release-target.outputs.release_cible }}
diff --git a/cmd/dhcp/main.go b/cmd/dhcp/main.go
new file mode 100644
index 0000000..b2ce08d
--- /dev/null
+++ b/cmd/dhcp/main.go
@@ -0,0 +1,64 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"net"
+	"os"
+
+	"git.g3e.fr/syonad/two/internal/dhcp"
+	"git.g3e.fr/syonad/two/pkg/systemd"
+)
+
+func main() {
+	subnet := flag.String("subnet", "", "Subnet CIDR (e.g. 10.10.10.0/24)")
+	name := flag.String("name", "", "Config name (e.g. vpc1_br-00002)")
+	gateway := flag.String("gateway", "", "Gateway IP (e.g. 10.10.10.1)")
+	confDir := flag.String("confdir", "/etc/dnsmasq.d", "dnsmasq config directory")
+	flag.Parse()
+
+	if *subnet == "" || *name == "" || *gateway == "" {
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	_, network, err := net.ParseCIDR(*subnet)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "invalid subnet: %v\n", err)
+		os.Exit(1)
+	}
+
+	gw := net.ParseIP(*gateway)
+	if gw == nil {
+		fmt.Fprintf(os.Stderr, "invalid gateway IP: %q\n", *gateway)
+		os.Exit(1)
+	}
+
+	conf := dhcp.Config{
+		Network: network,
+		Gateway: gw,
+		Name:    *name,
+		ConfDir: *confDir,
+	}
+
+	confPath, err := dhcp.GenerateConfig(conf)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error generating config: %v\n", err)
+		os.Exit(1)
+	}
+	fmt.Printf("dnsmasq config written to %s\n", confPath)
+
+	svc, err := systemd.New()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error connecting to systemd: %v\n", err)
+		os.Exit(1)
+	}
+	defer svc.Close()
+
+	unit := "dnsmasq@" + *name + ".service"
+	if err := svc.Start(unit); err != nil {
+		fmt.Fprintf(os.Stderr, "error starting %s: %v\n", unit, err)
+		os.Exit(1)
+	}
+	fmt.Printf("started %s\n", unit)
+}
diff --git a/cmd/subnet/main.go b/cmd/subnet/main.go
new file mode 100644
index 0000000..05ecd47
--- /dev/null
+++ b/cmd/subnet/main.go
@@ -0,0 +1,93 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	configuration "git.g3e.fr/syonad/two/internal/config/agent"
+	"git.g3e.fr/syonad/two/internal/subnet"
+	"git.g3e.fr/syonad/two/pkg/db/kv"
+
+	"github.com/dgraph-io/badger/v4"
+)
+
+var (
+	name       = flag.String("name", "", "Subnet name (ex: sn-00001)")
+	vpcName    = flag.String("vpc", "", "VPC name")
+	vxlanID    = flag.String("vxlan-id", "", "VXLAN ID")
+	localIP    = flag.String("local-ip", "", "Local VTEP IP")
+	gatewayIP  = flag.String("gateway-ip", "", "Gateway IP")
+	cidr       = flag.String("cidr", "", "Subnet CIDR (ex: 10.10.10.0/24)")
+	action     = flag.String("action", "", "Action à effectuer")
+	conf_file  = flag.String("conf", "/etc/two/agent.yml", "Configuration file")
+)
+
+var DB *badger.DB
+
+func main() {
+	flag.Parse()
+
+	conf, err := configuration.LoadConfig(*conf_file)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+
+	DB = kv.InitDB(kv.Config{
+		Path: conf.Database.Path,
+	}, false)
+	defer DB.Close()
+
+	switch *action {
+	case "create":
+		if *name == "" || *vpcName == "" || *vxlanID == "" || *localIP == "" || *gatewayIP == "" || *cidr == "" {
+			fmt.Println("create requires: -name -vpc -vxlan-id -local-ip -gateway-ip -cidr")
+			os.Exit(1)
+		}
+		kv.AddInDB(DB, "subnet/"+*name+"/state", "creating")
+		kv.AddInDB(DB, "subnet/"+*name+"/vpc", *vpcName)
+		kv.AddInDB(DB, "subnet/"+*name+"/vxlan_id", *vxlanID)
+		kv.AddInDB(DB, "subnet/"+*name+"/local_ip", *localIP)
+		kv.AddInDB(DB, "subnet/"+*name+"/gateway_ip", *gatewayIP)
+		kv.AddInDB(DB, "subnet/"+*name+"/cidr", *cidr)
+		if err := subnet.CreateSubnet(DB, *name); err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+
+	case "delete":
+		if *name == "" {
+			fmt.Println("delete requires: -name")
+			os.Exit(1)
+		}
+		kv.AddInDB(DB, "subnet/"+*name+"/state", "deleting")
+		if err := subnet.DeleteSubnet(DB, *name); err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+		if state, err := kv.GetFromDB(DB, "subnet/"+*name+"/state"); err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		} else if state == "deleted" {
+			kv.DeleteInDB(DB, "subnet/"+*name)
+		}
+
+	case "check":
+		if *name == "" {
+			fmt.Println("check requires: -name")
+			os.Exit(1)
+		}
+		if state, err := kv.GetFromDB(DB, "subnet/"+*name+"/state"); err != nil {
+			os.Exit(1)
+		} else if state != "created" {
+			os.Exit(1)
+		}
+
+	default:
+		fmt.Printf("Available commands:\n - create\n - delete\n - check\n")
+		os.Exit(1)
+	}
+
+	os.Exit(0)
+}
diff --git a/systemd/agent.service b/systemd/agent.service
deleted file mode 100644
index 37715c4..0000000
--- a/systemd/agent.service
+++ /dev/null
@@ -1,10 +0,0 @@
-[Unit]
-Description=Agent service
-After=network.target
-
-[Service]
-Type=simple
-ExecStart=/opt/two/bin/agent
-
-[Install]
-WantedBy=multi-user.target