diff --git a/etc/network.subr b/etc/network.subr
index 36e0140bff9a..f92cab1b1015 100644
--- a/etc/network.subr
+++ b/etc/network.subr
@@ -82,6 +82,41 @@ ifn_stop()
 	return $cfg
 }
 
+# ifn_vnetup ifn
+#	Move ifn to the specified vnet jail.
+#
+ifn_vnetup()
+{
+
+	ifn_vnet0 $1 vnet
+}
+
+# ifn_vnetdown ifn
+#	Reclaim ifn from the specified vnet jail.
+#
+ifn_vnetdown()
+{
+
+	ifn_vnet0 $1 -vnet
+}
+
+# ifn_vnet0 ifn action
+#	Helper function for ifn_vnetup and ifn_vnetdown.
+#
+ifn_vnet0()
+{
+	local _ifn _cfg _action _vnet
+	_ifn="$1"
+	_action="$2"
+	_cfg=1
+
+	if _vnet=$(vnetif $_ifn); then
+		${IFCONFIG_CMD} $_ifn $_action $_vnet && _cfg=0
+	fi
+
+	return $_cfg
+}
+
 # ifconfig_up if
 #	Evaluate ifconfig(8) arguments for interface $if and
 #	run ifconfig(8) with those arguments. It returns 0 if
@@ -284,24 +319,27 @@ _ifconfig_getargs()
 #	args such as DHCP and WPA.
 ifconfig_getargs()
 {
-	local _tmpargs _arg _args
+	local _tmpargs _arg _args _vnet
 	_tmpargs=`_ifconfig_getargs $1 $2`
 	if [ $? -eq 1 ]; then
 		return 1
 	fi
 	_args=
+	_vnet=0
 
 	for _arg in $_tmpargs; do
-		case $_arg in
-		[Dd][Hh][Cc][Pp]) ;;
-		[Nn][Oo][Aa][Uu][Tt][Oo]) ;;
-		[Nn][Oo][Ss][Yy][Nn][Cc][Dd][Hh][Cc][Pp]) ;;
-		[Ss][Yy][Nn][Cc][Dd][Hh][Cc][Pp]) ;;
-		[Ww][Pp][Aa]) ;;
-		[Hh][Oo][Ss][Tt][Aa][Pp]) ;;
-		*)
+		case $_arg:$_vnet in
+		[Dd][Hh][Cc][Pp]:0) ;;
+		[Nn][Oo][Aa][Uu][Tt][Oo]:0) ;;
+		[Nn][Oo][Ss][Yy][Nn][Cc][Dd][Hh][Cc][Pp]:0) ;;
+		[Ss][Yy][Nn][Cc][Dd][Hh][Cc][Pp]:0) ;;
+		[Ww][Pp][Aa]:0) ;;
+		[Hh][Oo][Ss][Tt][Aa][Pp]:0) ;;
+		vnet:0)	_vnet=1 ;;
+		*:1)	_vnet=0 ;;
+		*:0)
 			_args="$_args $_arg"
-			;;
+		;;
 		esac
 	done
 
@@ -426,6 +464,25 @@ hostapif()
 	return 1
 }
 
+# vnetif if
+#	Returns 0 and echo jail if "vnet" keyword is specified on the
+#	interface, and 1 otherwise.
+vnetif()
+{
+	local _tmpargs _arg _vnet
+	_tmpargs=`_ifconfig_getargs $1`
+
+	_vnet=0
+	for _arg in $_tmpargs; do
+		case $_arg:$_vnet in
+		vnet:0)	_vnet=1 ;;
+		*:1)	echo $_arg; return 0 ;;
+		esac
+	done
+
+	return 1
+}
+
 # afexists af
 #	Returns 0 if the address family is enabled in the kernel
 #	1 otherwise.
diff --git a/etc/rc.d/netif b/etc/rc.d/netif
index 2cb7754b0636..daece80c2153 100755
--- a/etc/rc.d/netif
+++ b/etc/rc.d/netif
@@ -39,7 +39,9 @@ stop_cmd="network_stop"
 cloneup_cmd="clone_up"
 clonedown_cmd="clone_down"
 clear_cmd="doclear"
-extra_commands="cloneup clonedown clear"
+vnetup_cmd="vnet_up"
+vnetdown_cmd="vnet_down"
+extra_commands="cloneup clonedown clear vnetup vnetdown"
 cmdifn=
 
 set_rcvar_obsolete ipv6_enable ipv6_activate_all_interfaces
@@ -123,6 +125,20 @@ network_stop0()
 	fi
 }
 
+vnet_up()
+{
+	cmdifn=$*
+
+	network_common ifn_vnetup $cmdifn
+}
+
+vnet_down()
+{
+	cmdifn=$*
+
+	network_common ifn_vnetdown $cmdifn
+}
+
 # network_common routine
 #	Common configuration subroutine for network interfaces. This
 #	routine takes all the preparatory steps needed for configuriing
@@ -198,7 +214,7 @@ network_common()
 
 	# inet6 address configuration needs sleep for DAD.
 	case ${_func}:${_dadwait} in
-	ifn_start:1)
+	ifn_start:1|ifn_vnetup:1|ifn_vnetdown:1)
 		sleep `${SYSCTL_N} net.inet6.ip6.dad_count`
 		sleep 1
 	;;
@@ -209,12 +225,25 @@ network_common()
 		case ${_func} in
 		ifn_start)
 			_str='Starting'
-			;;
+		;;
 		ifn_stop)
 			_str='Stopping'
-			;;
+		;;
+		ifn_vnetup)
+			_str='Moving'
+		;;
+		ifn_vnetdown)
+			_str='Reclaiming'
+		;;
 		esac
 		echo "${_str} Network:${_ok}."
+		case ${_func} in
+		ifn_vnetup)
+			# Clear _ok not to do "ifconfig $ifn"
+			# because $ifn is no longer in the current vnet.
+			_ok=
+		;;
+		esac
 		if check_startmsgs; then
 			for ifn in ${_ok}; do
 				/sbin/ifconfig ${ifn}