diff --git a/lxd/network/driver_ovn.go b/lxd/network/driver_ovn.go
index <HASH>..<HASH> 100644
--- a/lxd/network/driver_ovn.go
+++ b/lxd/network/driver_ovn.go
@@ -141,7 +141,7 @@ func (n *ovn) validateExternalSubnet(uplinkRoutes []*net.IPNet, projectRestricte
 	if projectRestrictedSubnets != nil {
 		foundMatch := false
 		for _, projectRestrictedSubnet := range projectRestrictedSubnets {
-			if !SubnetContains(projectRestrictedSubnet, ipNet) {
+			if SubnetContains(projectRestrictedSubnet, ipNet) {
 				foundMatch = true
 				break
 			}
lxd/network/driver/ovn: Fix project restricted subnets check in validateExternalSubnet