diff --git a/sys/net/if_tap.c b/sys/net/if_tap.c
index 4ff5a49f598e..aa18612910a4 100644
--- a/sys/net/if_tap.c
+++ b/sys/net/if_tap.c
@@ -42,6 +42,7 @@
 #include <sys/conf.h>
 #include <sys/fcntl.h>
 #include <sys/filio.h>
+#include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
@@ -66,6 +67,7 @@
 #include <net/if_dl.h>
 #include <net/route.h>
 #include <net/if_types.h>
+#include <net/vnet.h>
 
 #include <netinet/in.h>
 
@@ -214,6 +216,7 @@ tap_destroy(struct tap_softc *tp)
 	KASSERT(!(tp->tap_flags & TAP_OPEN),
 		("%s flags is out of sync", ifp->if_xname));
 
+	CURVNET_SET(ifp->if_vnet);
 	seldrain(&tp->tap_rsel);
 	knlist_destroy(&tp->tap_rsel.si_note);
 	destroy_dev(tp->tap_dev);
@@ -222,6 +225,7 @@ tap_destroy(struct tap_softc *tp)
 
 	mtx_destroy(&tp->tap_mtx);
 	free(tp, M_TAP);
+	CURVNET_RESTORE();
 }
 
 static void
@@ -363,6 +367,7 @@ tapclone(void *arg, struct ucred *cred, char *name, int namelen, struct cdev **d
 	if (unit == -1)
 		append_unit = 1;
 
+	CURVNET_SET(CRED_TO_VNET(cred));
 	/* find any existing device, or allocate new unit number */
 	i = clone_create(&tapclones, &tap_cdevsw, &unit, dev, extra);
 	if (i) {
@@ -381,6 +386,7 @@ tapclone(void *arg, struct ucred *cred, char *name, int namelen, struct cdev **d
 	}
 
 	if_clone_create(name, namelen, NULL);
+	CURVNET_RESTORE();
 } /* tapclone */
 
 
@@ -521,6 +527,7 @@ tapclose(struct cdev *dev, int foo, int bar, struct thread *td)
 
 	/* junk all pending output */
 	mtx_lock(&tp->tap_mtx);
+	CURVNET_SET(ifp->if_vnet);
 	IF_DRAIN(&ifp->if_snd);
 
 	/*
@@ -544,6 +551,8 @@ tapclose(struct cdev *dev, int foo, int bar, struct thread *td)
 	}
 
 	if_link_state_change(ifp, LINK_STATE_DOWN);
+	CURVNET_RESTORE();
+
 	funsetown(&tp->tap_sigio);
 	selwakeuppri(&tp->tap_rsel, PZERO+1);
 	KNOTE_LOCKED(&tp->tap_rsel.si_note, 0);
@@ -945,7 +954,9 @@ tapwrite(struct cdev *dev, struct uio *uio, int flag)
 	}
 
 	/* Pass packet up to parent. */
+	CURVNET_SET(ifp->if_vnet);
 	(*ifp->if_input)(ifp, m);
+	CURVNET_RESTORE();
 	ifp->if_ipackets ++; /* ibytes are counted in parent */
 
 	return (0);