diff --git a/roles/dhcpd/templates/dhcp/dhcpd.conf.j2 b/roles/dhcpd/templates/dhcp/dhcpd.conf.j2
index 45d416e..25491ef 100644
--- a/roles/dhcpd/templates/dhcp/dhcpd.conf.j2
+++ b/roles/dhcpd/templates/dhcp/dhcpd.conf.j2
@@ -168,9 +168,9 @@ host schweinshaxn {
   fixed-address schweinshaxn.binary.kitchen;
 }
 
-host spiegelei {
-  hardware ethernet 00:23:7d:79:82:8e;
-  fixed-address spiegelei.binary.kitchen;
+host strammermax {
+  hardware ethernet 08:00:37:B8:55:44;
+  fixed-address strammermax.binary.kitchen;
 }
 
 host obatzda {
diff --git a/roles/dns-intern/templates/bind/23.172.in-addr.arpa.zone.j2 b/roles/dns-intern/templates/bind/23.172.in-addr.arpa.zone.j2
index e9eb6a6..33bf247 100644
--- a/roles/dns-intern/templates/bind/23.172.in-addr.arpa.zone.j2
+++ b/roles/dns-intern/templates/bind/23.172.in-addr.arpa.zone.j2
@@ -1,7 +1,7 @@
 $ORIGIN 23.172.in-addr.arpa.	; base for unqualified names
 $TTL 1h				; default time-to-live
 @				IN	SOA ns.binary.kitchen. hostmaster.binary.kitchen. (
-					2019040101; serial
+					2019062701; serial
 					1d; refresh
 					2h; retry
 					4w; expire
@@ -12,6 +12,8 @@ $TTL 1h				; default time-to-live
 1.0				IN	PTR	core.binary.kitchen.
 2.0				IN	PTR	erx-bk.binary.kitchen.
 3.0				IN	PTR	erx-rz.binary.kitchen.
+4.0				IN	PTR	pf-bk.binary.kitchen.
+5.0				IN	PTR	pf-rz.binary.kitchen.
 ; Management
 1.1				IN	PTR	v2301.core.binary.kitchen.
 11.1				IN	PTR	ups1.binary.kitchen.
@@ -46,7 +48,7 @@ $TTL 1h				; default time-to-live
 36.2				IN	PTR	schweinshaxn.binary.kitchen.
 44.2				IN	PTR	cashdesk.binary.kitchen.
 62.2				IN	PTR	bowle.binary.kitchen.
-91.2				IN	PTR	spiegelei.binary.kitchen.
+91.2				IN	PTR	strammermax.binary.kitchen.
 92.2				IN	PTR	obatzda.binary.kitchen.
 ; Clients
 1.3				IN	PTR	v2303.core.binary.kitchen.
@@ -71,9 +73,11 @@ $GENERATE 10-240 $.4		IN	PTR	dhcp-${0,3,d}-04.binary.kitchen.
 81.9				IN	PTR	salat-bmc.binary.kitchen.
 ; Services RZ
 23.8				IN	PTR	cernunnos.binary.kitchen.
-; VPN RZ
+; VPN RZ (ER-X)
 1.10				IN	PTR	vtun0.erx-rz.binary.kitchen.
 $GENERATE 2-254 $.10		IN	PTR	vpn-${0,3,d}-10.binary.kitchen.
+; VPN RZ (pf)
+$GENERATE 2-254 $.11		IN	PTR	vpn-${0,3,d}-11.binary.kitchen.
 ; Point-to-Point
 1.96				IN	PTR	v400.erx-bk.binary.kitchen.
 2.96				IN	PTR	v400.core.binary.kitchen.
diff --git a/roles/dns-intern/templates/bind/binary.kitchen.zone.j2 b/roles/dns-intern/templates/bind/binary.kitchen.zone.j2
index eb6b450..1effcdb 100644
--- a/roles/dns-intern/templates/bind/binary.kitchen.zone.j2
+++ b/roles/dns-intern/templates/bind/binary.kitchen.zone.j2
@@ -1,7 +1,7 @@
 $ORIGIN binary.kitchen		; base for unqualified names
 $TTL 1h				; default time-to-live
 @				IN	SOA ns.binary.kitchen. hostmaster.binary.kitchen. (
-					2019040101; serial
+					2019062701; serial
 					1d; refresh
 					2h; retry
 					4w; expire
@@ -26,6 +26,8 @@ radius				IN	A	172.23.2.4
 core				IN	A	172.23.0.1
 erx-bk				IN	A	172.23.0.2
 erx-rz				IN	A	172.23.0.3
+pf-bk				IN	A	172.23.0.4
+pf-rz				IN	A	172.23.0.5
 ; Management
 v2301.core			IN	A	172.23.1.1
 ups1				IN	A	172.23.1.11
@@ -60,7 +62,7 @@ apfelkuchen			IN	A	172.23.2.34
 schweinshaxn			IN	A	172.23.2.36
 cashdesk			IN	A	172.23.2.44
 bowle				IN	A	172.23.2.62
-spiegelei			IN	A	172.23.2.91
+strammermax			IN	A	172.23.2.91
 obatzda				IN	A	172.23.2.92
 ; Clients
 v2303.core			IN	A	172.23.3.1
@@ -85,9 +87,11 @@ salat				IN	A	172.23.9.61
 salat-bmc			IN	A	172.23.9.81
 ; Services RZ
 cernunnos			IN	A	172.23.8.23
-; VPN RZ
+; VPN RZ (ER-X)
 vtun0.erx-rz			IN	A	172.23.10.1
 $GENERATE 2-254 vpn-${0,3,d}-10	IN	A	172.23.10.$
+; VPN RZ (pf)
+$GENERATE 2-254 vpn-${0,3,d}-11	IN	A	172.23.11.$
 ; Point-to-Point
 v400.erx-bk			IN	A	172.23.96.1
 v400.core			IN	A	172.23.96.2