diff --git a/hw/dp8393x.c b/hw/dp8393x.c
index 067831d..e4caab0 100644
--- a/hw/dp8393x.c
+++ b/hw/dp8393x.c
@@ -889,7 +889,8 @@ void dp83932_init(NICInfo *nd, target_phys_addr_t base, int it_shift,
     s->watchdog = qemu_new_timer(vm_clock, dp8393x_watchdog, s);
     s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
 
-    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->netdev,
+                                          nd->model, nd->name,
                                           nic_can_receive, nic_receive, NULL,
                                           nic_cleanup, s);
 
diff --git a/hw/etraxfs_eth.c b/hw/etraxfs_eth.c
index 54786c5..a411dab 100644
--- a/hw/etraxfs_eth.c
+++ b/hw/etraxfs_eth.c
@@ -590,7 +590,8 @@ void *etraxfs_eth_init(NICInfo *nd, target_phys_addr_t base, int phyaddr)
 	eth->ethregs = cpu_register_io_memory(eth_read, eth_write, eth);
 	cpu_register_physical_memory (base, 0x5c, eth->ethregs);
 
-	eth->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+	eth->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->netdev,
+                                                nd->model, nd->name,
                                                 eth_can_receive, eth_receive,
                                                 NULL, eth_cleanup, eth);
 	eth->vc->opaque = eth;
diff --git a/hw/mcf_fec.c b/hw/mcf_fec.c
index f6d2bab..f9f437a 100644
--- a/hw/mcf_fec.c
+++ b/hw/mcf_fec.c
@@ -462,7 +462,8 @@ void mcf_fec_init(NICInfo *nd, target_phys_addr_t base, qemu_irq *irq)
                                            mcf_fec_writefn, s);
     cpu_register_physical_memory(base, 0x400, s->mmio_index);
 
-    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->netdev,
+                                          nd->model, nd->name,
                                           mcf_fec_can_receive, mcf_fec_receive,
                                           NULL, mcf_fec_cleanup, s);
     memcpy(s->macaddr, nd->macaddr, 6);
diff --git a/hw/mipsnet.c b/hw/mipsnet.c
index e98c576..ea8b570 100644
--- a/hw/mipsnet.c
+++ b/hw/mipsnet.c
@@ -262,8 +262,9 @@ void mipsnet_init (int base, qemu_irq irq, NICInfo *nd)
 
     s->io_base = base;
     s->irq = irq;
-    if (nd && nd->vlan) {
-        s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+    if (nd) {
+        s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->netdev,
+                                              nd->model, nd->name,
                                               mipsnet_can_receive, mipsnet_receive,
                                               NULL, mipsnet_cleanup, s);
     } else {
diff --git a/hw/qdev.c b/hw/qdev.c
index 906e897..20f931c 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -370,8 +370,10 @@ VLANClientState *qdev_get_vlan_client(DeviceState *dev,
 {
     NICInfo *nd = dev->nd;
     assert(nd);
-    nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name, can_receive,
-                                  receive, receive_iov, cleanup, opaque);
+    nd->vc = qemu_new_vlan_client(nd->vlan, nd->netdev,
+                                  nd->model, nd->name,
+                                  can_receive, receive, receive_iov,
+                                  cleanup, opaque);
     return nd->vc;
 }
 
diff --git a/hw/usb-net.c b/hw/usb-net.c
index b33e329..5c753e0 100644
--- a/hw/usb-net.c
+++ b/hw/usb-net.c
@@ -1460,7 +1460,8 @@ USBDevice *usb_net_init(NICInfo *nd)
 
     memcpy(s->mac, nd->macaddr, 6);
 
-    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->netdev,
+                                          nd->model, nd->name,
                                           usbnet_can_receive,
                                           usbnet_receive,
                                           NULL,
diff --git a/hw/xen_nic.c b/hw/xen_nic.c
index c9e9199..b09b48a 100644
--- a/hw/xen_nic.c
+++ b/hw/xen_nic.c
@@ -301,7 +301,7 @@ static int net_init(struct XenDevice *xendev)
 	return -1;
 
     vlan = qemu_find_vlan(netdev->xendev.dev, 1);
-    netdev->vs = qemu_new_vlan_client(vlan, "xen", NULL,
+    netdev->vs = qemu_new_vlan_client(vlan, NULL, "xen", NULL,
                                       net_rx_ok, net_rx_packet, NULL,
                                       NULL, netdev);
     snprintf(netdev->vs->info_str, sizeof(netdev->vs->info_str),
diff --git a/net.c b/net.c
index 3f997cc..5d78f04 100644
--- a/net.c
+++ b/net.c
@@ -302,6 +302,7 @@ static char *assign_name(VLANClientState *vc1, const char *model)
 }
 
 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
+                                      VLANClientState *peer,
                                       const char *model,
                                       const char *name,
                                       NetCanReceive *can_receive,
@@ -326,9 +327,14 @@ VLANClientState *qemu_new_vlan_client(VLANState *vlan,
     vc->opaque = opaque;
 
     if (vlan) {
+        assert(!peer);
         vc->vlan = vlan;
         QTAILQ_INSERT_TAIL(&vc->vlan->clients, vc, next);
     } else {
+        if (peer) {
+            vc->peer = peer;
+            peer->peer = vc;
+        }
         QTAILQ_INSERT_TAIL(&non_vlan_clients, vc, next);
     }
 
@@ -341,6 +347,9 @@ void qemu_del_vlan_client(VLANClientState *vc)
         QTAILQ_REMOVE(&vc->vlan->clients, vc, next);
     } else {
         QTAILQ_REMOVE(&non_vlan_clients, vc, next);
+        if (vc->peer) {
+            vc->peer->peer = NULL;
+        }
     }
 
     if (vc->cleanup) {
@@ -866,7 +875,8 @@ static int net_slirp_init(VLANState *vlan, const char *model,
     }
 #endif
 
-    s->vc = qemu_new_vlan_client(vlan, model, name, NULL, slirp_receive, NULL,
+    s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
+                                 slirp_receive, NULL,
                                  net_slirp_cleanup, s);
     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
              "net=%s, restricted=%c", inet_ntoa(net), restricted ? 'y' : 'n');
@@ -1426,8 +1436,9 @@ static TAPState *net_tap_fd_init(VLANState *vlan,
 
     s = qemu_mallocz(sizeof(TAPState));
     s->fd = fd;
-    s->vc = qemu_new_vlan_client(vlan, model, name, NULL, tap_receive,
-                                 tap_receive_iov, tap_cleanup, s);
+    s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
+                                 tap_receive, tap_receive_iov,
+                                 tap_cleanup, s);
     tap_read_poll(s, 1);
     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "fd=%d", fd);
     return s;
@@ -1760,8 +1771,9 @@ static int net_vde_init(VLANState *vlan, const char *model,
         free(s);
         return -1;
     }
-    s->vc = qemu_new_vlan_client(vlan, model, name, NULL, vde_receive,
-                                 NULL, vde_cleanup, s);
+    s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
+                                 vde_receive, NULL,
+                                 vde_cleanup, s);
     qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "sock=%s,fd=%d",
              sock, vde_datafd(s->vde));
@@ -1999,8 +2011,9 @@ static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
     s = qemu_mallocz(sizeof(NetSocketState));
     s->fd = fd;
 
-    s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive_dgram,
-                                 NULL, net_socket_cleanup, s);
+    s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
+                                 net_socket_receive_dgram, NULL,
+                                 net_socket_cleanup, s);
     qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
 
     /* mcast: save bound address as dst */
@@ -2027,8 +2040,9 @@ static NetSocketState *net_socket_fd_init_stream(VLANState *vlan,
     NetSocketState *s;
     s = qemu_mallocz(sizeof(NetSocketState));
     s->fd = fd;
-    s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive,
-                                 NULL, net_socket_cleanup, s);
+    s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
+                                 net_socket_receive, NULL,
+                                 net_socket_cleanup, s);
     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
              "socket: fd=%d", fd);
     if (is_connected) {
@@ -2308,7 +2322,8 @@ static int net_dump_init(VLANState *vlan, const char *device,
         return -1;
     }
 
-    s->pcap_vc = qemu_new_vlan_client(vlan, device, name, NULL, dump_receive, NULL,
+    s->pcap_vc = qemu_new_vlan_client(vlan, NULL, device, name, NULL,
+                                      dump_receive, NULL,
                                       net_dump_cleanup, s);
     snprintf(s->pcap_vc->info_str, sizeof(s->pcap_vc->info_str),
              "dump to %s (len=%d)", filename, len);
diff --git a/net.h b/net.h
index e23047c..fa59c3d 100644
--- a/net.h
+++ b/net.h
@@ -28,6 +28,7 @@ struct VLANClientState {
     void *opaque;
     QTAILQ_ENTRY(VLANClientState) next;
     struct VLANState *vlan;
+    VLANClientState *peer;
     char *model;
     char *name;
     char info_str[256];
@@ -56,6 +57,7 @@ struct VLANState {
 
 VLANState *qemu_find_vlan(int id, int allocate);
 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
+                                      VLANClientState *peer,
                                       const char *model,
                                       const char *name,
                                       NetCanReceive *can_receive,
diff --git a/tap-win32.c b/tap-win32.c
index 2c02ce3..e4fdde8 100644
--- a/tap-win32.c
+++ b/tap-win32.c
@@ -677,7 +677,8 @@ int tap_win32_init(VLANState *vlan, const char *model,
         return -1;
     }
 
-    s->vc = qemu_new_vlan_client(vlan, model, name, NULL, tap_receive,
+    s->vc = qemu_new_vlan_client(vlan, NULL, model, name,
+                                 NULL, tap_receive,
                                  NULL, tap_cleanup, s);
 
     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
