diff --git a/kvmd/apps/__init__.py b/kvmd/apps/__init__.py
index e12e807e..404abb92 100644
--- a/kvmd/apps/__init__.py
+++ b/kvmd/apps/__init__.py
@@ -192,6 +192,14 @@ def _init_config(config_path: str, override_options: list[str], **load_flags: bo
 
 
 def _patch_raw(raw_config: dict) -> None:  # pylint: disable=too-many-branches
+    for (sub, cmd) in [("iface", "ip_cmd"), ("firewall", "iptables_cmd")]:
+        if isinstance(raw_config.get("otgnet"), dict):
+            if isinstance(raw_config["otgnet"].get(sub), dict):
+                if raw_config["otgnet"][sub].get(cmd):
+                    raw_config["otgnet"].setdefault("commands", {})
+                    raw_config["otgnet"]["commands"][cmd] = raw_config["otgnet"][sub][cmd]
+                    del raw_config["otgnet"][sub][cmd]
+
     if isinstance(raw_config.get("otg"), dict):
         for (old, new) in [
             ("msd", "msd"),
@@ -666,8 +674,7 @@ def _get_config_scheme() -> dict:
 
         "otgnet": {
             "iface": {
-                "net":    Option("172.30.30.0/24", type=functools.partial(valid_net, v6=False)),
-                "ip_cmd": Option(["/usr/bin/ip"],  type=valid_command),
+                "net": Option("172.30.30.0/24", type=functools.partial(valid_net, v6=False)),
             },
 
             "firewall": {
@@ -675,10 +682,12 @@ def _get_config_scheme() -> dict:
                 "allow_tcp":     Option([],   type=valid_ports_list),
                 "allow_udp":     Option([67], type=valid_ports_list),
                 "forward_iface": Option("",   type=valid_stripped_string),
-                "iptables_cmd":  Option(["/usr/sbin/iptables", "--wait=5"], type=valid_command),
             },
 
             "commands": {
+                "ip_cmd":       Option(["/usr/bin/ip"],  type=valid_command),
+                "iptables_cmd": Option(["/usr/sbin/iptables", "--wait=5"], type=valid_command),
+
                 "pre_start_cmd":        Option(["/bin/true", "pre-start"], type=valid_command),
                 "pre_start_cmd_remove": Option([], type=valid_options),
                 "pre_start_cmd_append": Option([], type=valid_options),
diff --git a/kvmd/apps/otgnet/__init__.py b/kvmd/apps/otgnet/__init__.py
index 35c0bc45..d335a4a7 100644
--- a/kvmd/apps/otgnet/__init__.py
+++ b/kvmd/apps/otgnet/__init__.py
@@ -63,14 +63,15 @@ class _Netcfg:  # pylint: disable=too-many-instance-attributes
 
 class _Service:  # pylint: disable=too-many-instance-attributes
     def __init__(self, config: Section) -> None:
+        self.__ip_cmd: list[str] = config.otgnet.commands.ip_cmd
+        self.__iptables_cmd: list[str] = config.otgnet.commands.iptables_cmd
+
         self.__iface_net: str = config.otgnet.iface.net
-        self.__ip_cmd: list[str] = config.otgnet.iface.ip_cmd
 
         self.__allow_icmp: bool = config.otgnet.firewall.allow_icmp
         self.__allow_tcp: list[int] = sorted(set(config.otgnet.firewall.allow_tcp))
         self.__allow_udp: list[int] = sorted(set(config.otgnet.firewall.allow_udp))
         self.__forward_iface: str = config.otgnet.firewall.forward_iface
-        self.__iptables_cmd: list[str] = config.otgnet.firewall.iptables_cmd
 
         def build_cmd(key: str) -> list[str]:
             return tools.build_cmd(