your NS file:

	tb-set-netmask $lan0  "255.255.240.0"
	tb-set-netmask $link0 "255.255.255.248"
	tb-set-netmask $link1 "255.255.255.240"

Yep, more rope for the user to hang herself with. Notes:

* You are restricted to 255.255.XXX.XXX. I did not see a reason to
  allow the user that much rope.

* get_subnet can handle 10 or 192.168 addresses so that other sites
  can continue to operate without changing to 10 addresses, although
  they will still be able to change the netmask.

* I've changed the handling for widearea networks to use 192.168, but
  I force the netmask to 255.255.255.248 so that we are not restricted
  to just 255 networks (not that it really matters). To avoid possible
  confusion, the user is not allowed to choose their own IPs for
  widearea networks, and I actually set them to 1.1.x.x, and then
  patch it up later. This is to avoid conflict with existing
  experiments where people may have used tb-set-ip in their NS files.

* There are tmcd and staticroutes and image changes that are required
  to make this all work right!