diff --git a/go.mod b/go.mod
index d441392a49..18c04d39f4 100644
--- a/go.mod
+++ b/go.mod
@@ -144,7 +144,7 @@ require (
 	yunion.io/x/jsonutils v0.0.0-20201022101715-4e3add1ac4aa
 	yunion.io/x/log v0.0.0-20200313080802-57a4ce5966b3
 	yunion.io/x/ovsdb v0.0.0-20200526071744-27bf0940cbc7
-	yunion.io/x/pkg v0.0.0-20200814072949-4f1b541857d6
+	yunion.io/x/pkg v0.0.0-20201028134817-3ed15ee169bc
 	yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e
 	yunion.io/x/sqlchemy v0.0.0-20201014101037-8fe75542e6d8
 	yunion.io/x/structarg v0.0.0-20200720093445-9f850fa222ce
diff --git a/go.sum b/go.sum
index be8ab3744e..7709b5226f 100644
--- a/go.sum
+++ b/go.sum
@@ -1136,6 +1136,8 @@ yunion.io/x/pkg v0.0.0-20190620104149-945c25821dbf/go.mod h1:t6rEGG2sQ4J7DhFxSZV
 yunion.io/x/pkg v0.0.0-20190628082551-f4033ba2ea30/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
 yunion.io/x/pkg v0.0.0-20200814072949-4f1b541857d6 h1:UarEDTBGkgcgc+nc+PZ75uo9M9+jiOGd5P2B90TxDNw=
 yunion.io/x/pkg v0.0.0-20200814072949-4f1b541857d6/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
+yunion.io/x/pkg v0.0.0-20201028134817-3ed15ee169bc h1:cgwWI6k9LsXpq6yiOuEIprsXmPyPGUa60sOZu57e8Jo=
+yunion.io/x/pkg v0.0.0-20201028134817-3ed15ee169bc/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
 yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e h1:v+EzIadodSwkdZ/7bremd7J8J50Cise/HCylsOJngmo=
 yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e/go.mod h1:0iFKpOs1y4lbCxeOmq3Xx/0AcQoewVPwj62eRluioEo=
 yunion.io/x/sqlchemy v0.0.0-20201014101037-8fe75542e6d8 h1:AkPrqO37Yi3aICys9qDjTlSdVVGh2pWQ8ET+dSJmhoI=
diff --git a/pkg/apis/identity/consts.go b/pkg/apis/identity/consts.go
index 173787eeaf..5fe371ecc6 100644
--- a/pkg/apis/identity/consts.go
+++ b/pkg/apis/identity/consts.go
@@ -105,6 +105,7 @@ var (
 			"time_zone",
 			"domainized_namespace",
 			"api_server",
+			"customized_private_prefixes",
 		},
 	}
 
diff --git a/pkg/cloudcommon/options/changes.go b/pkg/cloudcommon/options/changes.go
index 03d42d77e4..17e3ed776b 100644
--- a/pkg/cloudcommon/options/changes.go
+++ b/pkg/cloudcommon/options/changes.go
@@ -15,6 +15,11 @@
 package options
 
 import (
+	"sort"
+
+	"yunion.io/x/log"
+	"yunion.io/x/pkg/util/netutils"
+
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 )
 
@@ -24,6 +29,7 @@ func OnBaseOptionsChange(oOpts, nOpts interface{}) bool {
 
 	changed := false
 	if oldOpts.RequestWorkerCount != newOpts.RequestWorkerCount {
+		log.Debugf("RequestWorkerCount changed from %d to %d", oldOpts.RequestWorkerCount, newOpts.RequestWorkerCount)
 		changed = true
 	}
 	if oldOpts.TimeZone != newOpts.TimeZone {
@@ -40,9 +46,30 @@ func OnBaseOptionsChange(oOpts, nOpts interface{}) bool {
 		consts.SetDomainizedNamespace(newOpts.DomainizedNamespace)
 		changed = true
 	}
+	if privatePrrefixesChanged(oldOpts.CustomizedPrivatePrefixes, newOpts.CustomizedPrivatePrefixes) {
+		netutils.SetPrivatePrefixes(newOpts.CustomizedPrivatePrefixes)
+		log.Debugf("Customized private prefixes: %s", netutils.GetPrivateIPRanges())
+	}
 	return changed
 }
 
+func privatePrrefixesChanged(oldprefs, newprefs []string) bool {
+	if len(oldprefs) != len(newprefs) {
+		return true
+	}
+	if len(oldprefs) == 0 {
+		return false
+	}
+	sort.Strings(oldprefs)
+	sort.Strings(newprefs)
+	for i := range newprefs {
+		if oldprefs[i] != newprefs[i] {
+			return true
+		}
+	}
+	return false
+}
+
 func OnCommonOptionsChange(oOpts, nOpts interface{}) bool {
 	oldOpts := oOpts.(*CommonOptions)
 	newOpts := nOpts.(*CommonOptions)
diff --git a/pkg/cloudcommon/options/options.go b/pkg/cloudcommon/options/options.go
index 1bb876eb64..a5a3c546e3 100644
--- a/pkg/cloudcommon/options/options.go
+++ b/pkg/cloudcommon/options/options.go
@@ -90,6 +90,8 @@ type BaseOptions struct {
 
 	ApiServer string `help:"URL to access frontend webconsole"`
 
+	CustomizedPrivatePrefixes []string `help:"customized private prefixes"`
+
 	structarg.BaseOptions
 }
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 66bc82840c..86796c962c 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1077,7 +1077,7 @@ yunion.io/x/log/hooks
 yunion.io/x/ovsdb/cli_util
 yunion.io/x/ovsdb/schema/ovn_nb
 yunion.io/x/ovsdb/types
-# yunion.io/x/pkg v0.0.0-20200814072949-4f1b541857d6
+# yunion.io/x/pkg v0.0.0-20201028134817-3ed15ee169bc
 yunion.io/x/pkg/errors
 yunion.io/x/pkg/gotypes
 yunion.io/x/pkg/prettytable
diff --git a/vendor/yunion.io/x/pkg/util/compare/compare.go b/vendor/yunion.io/x/pkg/util/compare/compare.go
index f3e4bf65c4..4c3d62b1f6 100644
--- a/vendor/yunion.io/x/pkg/util/compare/compare.go
+++ b/vendor/yunion.io/x/pkg/util/compare/compare.go
@@ -97,8 +97,10 @@ func CompareSets(dbSet interface{}, extSet interface{}, removed interface{}, com
 				i += 1
 				j += 1
 			} else if cmp < 0 {
-				newVal := reflect.Append(removedValue, dbSetArray[i].value)
-				removedValue.Set(newVal)
+				if len(dbSetArray[i].key) > 0 {
+					newVal := reflect.Append(removedValue, dbSetArray[i].value)
+					removedValue.Set(newVal)
+				}
 				i += 1
 			} else {
 				newVal := reflect.Append(addedValue, extSetArray[j].value)
@@ -110,8 +112,10 @@ func CompareSets(dbSet interface{}, extSet interface{}, removed interface{}, com
 			addedValue.Set(newVal)
 			j += 1
 		} else if j >= len(extSetArray) {
-			newVal := reflect.Append(removedValue, dbSetArray[i].value)
-			removedValue.Set(newVal)
+			if len(dbSetArray[i].key) > 0 {
+				newVal := reflect.Append(removedValue, dbSetArray[i].value)
+				removedValue.Set(newVal)
+			}
 			i += 1
 		}
 	}
diff --git a/vendor/yunion.io/x/pkg/util/netutils/netutils.go b/vendor/yunion.io/x/pkg/util/netutils/netutils.go
index 1f03f3a135..99a5c0cdfa 100644
--- a/vendor/yunion.io/x/pkg/util/netutils/netutils.go
+++ b/vendor/yunion.io/x/pkg/util/netutils/netutils.go
@@ -416,23 +416,14 @@ const (
 	multicastPrefix = "224.0.0.0/4"
 )
 
-var privatePrefixes = []string{
-	"10.0.0.0/8",
-	"172.16.0.0/12",
-	"192.168.0.0/16",
-}
-
 var privateIPRanges []IPV4AddrRange
 var hostLocalIPRange IPV4AddrRange
 var linkLocalIPRange IPV4AddrRange
 var multicastIPRange IPV4AddrRange
 
 func init() {
-	privateIPRanges = make([]IPV4AddrRange, len(privatePrefixes))
-	for i, prefix := range privatePrefixes {
-		prefix, _ := NewIPV4Prefix(prefix)
-		privateIPRanges[i] = prefix.ToIPRange()
-	}
+	updatePrivateIPRanges(nil)
+
 	prefix, _ := NewIPV4Prefix(hostlocalPrefix)
 	hostLocalIPRange = prefix.ToIPRange()
 	prefix, _ = NewIPV4Prefix(linklocalPrefix)
@@ -441,6 +432,32 @@ func init() {
 	multicastIPRange = prefix.ToIPRange()
 }
 
+func updatePrivateIPRanges(prefs []string) {
+	if len(prefs) == 0 {
+		prefs = []string{
+			"10.0.0.0/8",
+			"172.16.0.0/12",
+			"192.168.0.0/16",
+		}
+	}
+	privateIPRanges = make([]IPV4AddrRange, len(prefs))
+	for i, prefix := range prefs {
+		prefix, err := NewIPV4Prefix(prefix)
+		if err != nil {
+			continue
+		}
+		privateIPRanges[i] = prefix.ToIPRange()
+	}
+}
+
+func SetPrivatePrefixes(pref []string) {
+	updatePrivateIPRanges(pref)
+}
+
+func GetPrivateIPRanges() []IPV4AddrRange {
+	return privateIPRanges
+}
+
 func IsPrivate(addr IPV4Addr) bool {
 	for _, ipRange := range privateIPRanges {
 		if ipRange.Contains(addr) {