diff --git a/net.c b/net.c
index 18c51190bf5ff20625ecaf3de45bd4aab4403044..f26c3f804ec5d234f76e14200e1188d21923a732 100644
--- a/net.c
+++ b/net.c
@@ -669,12 +669,14 @@ static void config_error(Monitor *mon, const char *fmt, ...)
 
 /* slirp network adapter */
 
-#define SLIRP_CFG_REDIR 1
+#define SLIRP_CFG_HOSTFWD 1
+#define SLIRP_CFG_LEGACY  2
 
 struct slirp_config_str {
     struct slirp_config_str *next;
     int flags;
     char str[1024];
+    int legacy_format;
 };
 
 static int slirp_inited;
@@ -683,13 +685,14 @@ const char *legacy_tftp_prefix;
 const char *legacy_bootp_filename;
 static VLANClientState *slirp_vc;
 
-static void slirp_redirection(Monitor *mon, const char *redir_str);
-static void vmchannel_init(Monitor *mon, const char *config_str);
+static void slirp_hostfwd(Monitor *mon, const char *redir_str);
+static void slirp_guestfwd(Monitor *mon, const char *config_str,
+                           int legacy_format);
 
 #ifndef _WIN32
 static const char *legacy_smb_export;
 
-static void slirp_smb(const char *exported_dir);
+static void slirp_smb(const char *exported_dir, struct in_addr vserver_addr);
 #endif
 
 int slirp_can_output(void)
@@ -731,31 +734,122 @@ static void net_slirp_cleanup(VLANClientState *vc)
 }
 
 static int net_slirp_init(Monitor *mon, VLANState *vlan, const char *model,
-                          const char *name, int restricted, const char *ip,
-                          const char *tftp_export, const char *bootfile,
-                          const char *smb_export)
+                          const char *name, int restricted,
+                          const char *vnetwork, const char *vhost,
+                          const char *vhostname, const char *tftp_export,
+                          const char *bootfile, const char *vdhcp_start,
+                          const char *vnameserver, const char *smb_export,
+                          const char *vsmbserver)
 {
     if (slirp_in_use) {
         /* slirp only supports a single instance so far */
         return -1;
     }
     if (!slirp_inited) {
+        /* default settings according to historic slirp */
+        struct in_addr net  = { .s_addr = htonl(0x0a000000) }; /* 10.0.0.0 */
+        struct in_addr mask = { .s_addr = htonl(0xff000000) }; /* 255.0.0.0 */
+        struct in_addr host = { .s_addr = htonl(0x0a000202) }; /* 10.0.2.2 */
+        struct in_addr dhcp = { .s_addr = htonl(0x0a00020f) }; /* 10.0.2.15 */
+        struct in_addr dns  = { .s_addr = htonl(0x0a000203) }; /* 10.0.2.3 */
+#ifndef _WIN32
+        struct in_addr smbsrv = { .s_addr = 0 };
+#endif
+        char buf[20];
+        uint32_t addr;
+        int shift;
+        char *end;
+
         if (!tftp_export) {
             tftp_export = legacy_tftp_prefix;
         }
         if (!bootfile) {
             bootfile = legacy_bootp_filename;
         }
+
+        if (vnetwork) {
+            if (get_str_sep(buf, sizeof(buf), &vnetwork, '/') < 0) {
+                if (!inet_aton(vnetwork, &net)) {
+                    return -1;
+                }
+                addr = ntohl(net.s_addr);
+                if (!(addr & 0x80000000)) {
+                    mask.s_addr = htonl(0xff000000); /* class A */
+                } else if ((addr & 0xfff00000) == 0xac100000) {
+                    mask.s_addr = htonl(0xfff00000); /* priv. 172.16.0.0/12 */
+                } else if ((addr & 0xc0000000) == 0x80000000) {
+                    mask.s_addr = htonl(0xffff0000); /* class B */
+                } else if ((addr & 0xffff0000) == 0xc0a80000) {
+                    mask.s_addr = htonl(0xffff0000); /* priv. 192.168.0.0/16 */
+                } else if ((addr & 0xffff0000) == 0xc6120000) {
+                    mask.s_addr = htonl(0xfffe0000); /* tests 198.18.0.0/15 */
+                } else if ((addr & 0xe0000000) == 0xe0000000) {
+                    mask.s_addr = htonl(0xffffff00); /* class C */
+                } else {
+                    mask.s_addr = htonl(0xfffffff0); /* multicast/reserved */
+                }
+            } else {
+                if (!inet_aton(buf, &net)) {
+                    return -1;
+                }
+                shift = strtol(vnetwork, &end, 10);
+                if (*end != '\0') {
+                    if (!inet_aton(vnetwork, &mask)) {
+                        return -1;
+                    }
+                } else if (shift < 4 || shift > 32) {
+                    return -1;
+                } else {
+                    mask.s_addr = htonl(0xffffffff << (32 - shift));
+                }
+            }
+            net.s_addr &= mask.s_addr;
+            host.s_addr = net.s_addr | (htonl(0x0202) & ~mask.s_addr);
+            dhcp.s_addr = net.s_addr | (htonl(0x020f) & ~mask.s_addr);
+            dns.s_addr  = net.s_addr | (htonl(0x0203) & ~mask.s_addr);
+        }
+
+        if (vhost && !inet_aton(vhost, &host)) {
+            return -1;
+        }
+        if ((host.s_addr & mask.s_addr) != net.s_addr) {
+            return -1;
+        }
+
+        if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) {
+            return -1;
+        }
+        if ((dhcp.s_addr & mask.s_addr) != net.s_addr ||
+            dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) {
+            return -1;
+        }
+
+        if (vnameserver && !inet_aton(vnameserver, &dns)) {
+            return -1;
+        }
+        if ((dns.s_addr & mask.s_addr) != net.s_addr ||
+            dns.s_addr == host.s_addr) {
+            return -1;
+        }
+
+#ifndef _WIN32
+        if (vsmbserver && !inet_aton(vsmbserver, &smbsrv)) {
+            return -1;
+        }
+#endif
+
+        slirp_init(restricted, net, mask, host, vhostname, tftp_export,
+                   bootfile, dhcp, dns);
         slirp_inited = 1;
-        slirp_init(restricted, ip, tftp_export, bootfile);
 
         while (slirp_configs) {
             struct slirp_config_str *config = slirp_configs;
 
-            if (config->flags & SLIRP_CFG_REDIR) {
-                slirp_redirection(mon, config->str);
+            if (config->flags & SLIRP_CFG_HOSTFWD) {
+                slirp_hostfwd(mon, config->str);
             } else {
-                vmchannel_init(mon, config->str);
+                slirp_guestfwd(mon, config->str,
+                               config->flags & SLIRP_CFG_LEGACY);
             }
             slirp_configs = config->next;
             qemu_free(config);
@@ -765,7 +859,7 @@ static int net_slirp_init(Monitor *mon, VLANState *vlan, const char *model,
             smb_export = legacy_smb_export;
         }
         if (smb_export) {
-            slirp_smb(smb_export);
+            slirp_smb(smb_export, smbsrv);
         }
 #endif
     }
@@ -777,7 +871,7 @@ static int net_slirp_init(Monitor *mon, VLANState *vlan, const char *model,
     return 0;
 }
 
-static void net_slirp_redir_rm(Monitor *mon, const char *port_str)
+static void net_slirp_hostfwd_remove(Monitor *mon, const char *port_str)
 {
     int host_port;
     char buf[256] = "";
@@ -803,23 +897,24 @@ static void net_slirp_redir_rm(Monitor *mon, const char *port_str)
 
     host_port = atoi(p);
 
-    n = slirp_redir_rm(is_udp, host_port);
+    n = slirp_remove_hostfwd(is_udp, host_port);
 
-    monitor_printf(mon, "removed %d redirections to %s port %d\n", n,
-                        is_udp ? "udp" : "tcp", host_port);
+    monitor_printf(mon, "removed %d host forwarding rules for %s port %d\n",
+                   n, is_udp ? "udp" : "tcp", host_port);
     return;
 
  fail_syntax:
     monitor_printf(mon, "invalid format\n");
 }
 
-static void slirp_redirection(Monitor *mon, const char *redir_str)
+static void slirp_hostfwd(Monitor *mon, const char *redir_str)
 {
-    struct in_addr guest_addr;
+    struct in_addr guest_addr = { .s_addr = 0 };
     int host_port, guest_port;
     const char *p;
-    char buf[256], *r;
+    char buf[256];
     int is_udp;
+    char *end;
 
     p = redir_str;
     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
@@ -836,33 +931,31 @@ static void slirp_redirection(Monitor *mon, const char *redir_str)
     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
         goto fail_syntax;
     }
-    host_port = strtol(buf, &r, 0);
-    if (r == buf) {
+    host_port = strtol(buf, &end, 0);
+    if (*end != '\0' || host_port < 1 || host_port > 65535) {
         goto fail_syntax;
     }
 
     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
         goto fail_syntax;
     }
-    if (buf[0] == '\0') {
-        pstrcpy(buf, sizeof(buf), "10.0.2.15");
-    }
-    if (!inet_aton(buf, &guest_addr)) {
+    if (buf[0] != '\0' && !inet_aton(buf, &guest_addr)) {
         goto fail_syntax;
     }
 
-    guest_port = strtol(p, &r, 0);
-    if (r == p) {
+    guest_port = strtol(p, &end, 0);
+    if (*end != '\0' || guest_port < 1 || guest_port > 65535) {
         goto fail_syntax;
     }
 
-    if (slirp_redir(is_udp, host_port, guest_addr, guest_port) < 0) {
-        config_error(mon, "could not set up redirection '%s'\n", redir_str);
+    if (slirp_add_hostfwd(is_udp, host_port, guest_addr, guest_port) < 0) {
+        config_error(mon, "could not set up host forwarding rule '%s'\n",
+                     redir_str);
     }
     return;
 
  fail_syntax:
-    config_error(mon, "invalid redirection format '%s'\n", redir_str);
+    config_error(mon, "invalid host forwarding rule '%s'\n", redir_str);
 }
 
 void net_slirp_redir(Monitor *mon, const char *redir_str, const char *redir_opt2)
@@ -875,7 +968,7 @@ void net_slirp_redir(Monitor *mon, const char *redir_str, const char *redir_opt2
         } else {
             config = qemu_malloc(sizeof(*config));
             pstrcpy(config->str, sizeof(config->str), redir_str);
-            config->flags = SLIRP_CFG_REDIR;
+            config->flags = SLIRP_CFG_HOSTFWD;
             config->next = slirp_configs;
             slirp_configs = config;
         }
@@ -883,11 +976,11 @@ void net_slirp_redir(Monitor *mon, const char *redir_str, const char *redir_opt2
     }
 
     if (!strcmp(redir_str, "remove")) {
-        net_slirp_redir_rm(mon, redir_opt2);
+        net_slirp_hostfwd_remove(mon, redir_opt2);
         return;
     }
 
-    slirp_redirection(mon, redir_str);
+    slirp_hostfwd(mon, redir_str);
 }
 
 #ifndef _WIN32
@@ -925,7 +1018,7 @@ static void smb_exit(void)
     erase_dir(smb_dir);
 }
 
-static void slirp_smb(const char *exported_dir)
+static void slirp_smb(const char *exported_dir, struct in_addr vserver_addr)
 {
     char smb_conf[1024];
     char smb_cmdline[1024];
@@ -971,19 +1064,24 @@ static void slirp_smb(const char *exported_dir)
     snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
              SMBD_COMMAND, smb_conf);
 
-    slirp_add_exec(0, smb_cmdline, 4, 139);
+    if (slirp_add_exec(0, smb_cmdline, vserver_addr, 139) < 0) {
+        fprintf(stderr, "conflicting/invalid smbserver address\n");
+        exit(1);
+    }
 }
 
 /* automatic user mode samba server configuration (legacy interface) */
 void net_slirp_smb(const char *exported_dir)
 {
+    struct in_addr vserver_addr = { .s_addr = 0 };
+
     if (legacy_smb_export) {
         fprintf(stderr, "-smb given twice\n");
         exit(1);
     }
     legacy_smb_export = exported_dir;
     if (slirp_inited) {
-        slirp_smb(exported_dir);
+        slirp_smb(exported_dir, vserver_addr);
     }
 }
 
@@ -994,51 +1092,85 @@ void do_info_slirp(Monitor *mon)
     slirp_stats();
 }
 
-struct VMChannel {
+struct GuestFwd {
     CharDriverState *hd;
+    struct in_addr server;
     int port;
 };
 
-static int vmchannel_can_read(void *opaque)
+static int guestfwd_can_read(void *opaque)
 {
-    struct VMChannel *vmc = (struct VMChannel*)opaque;
-    return slirp_socket_can_recv(4, vmc->port);
+    struct GuestFwd *fwd = opaque;
+    return slirp_socket_can_recv(fwd->server, fwd->port);
 }
 
-static void vmchannel_read(void *opaque, const uint8_t *buf, int size)
+static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
 {
-    struct VMChannel *vmc = (struct VMChannel*)opaque;
-    slirp_socket_recv(4, vmc->port, buf, size);
+    struct GuestFwd *fwd = opaque;
+    slirp_socket_recv(fwd->server, fwd->port, buf, size);
 }
 
-static void vmchannel_init(Monitor *mon, const char *config_str)
+static void slirp_guestfwd(Monitor *mon, const char *config_str,
+                           int legacy_format)
 {
-    struct VMChannel *vmc;
-    char *devname;
-    char name[20];
+    struct in_addr server = { .s_addr = 0 };
+    struct GuestFwd *fwd;
+    const char *p;
+    char buf[128];
+    char *end;
     int port;
 
-    port = strtol(config_str, &devname, 10);
-    if (port < 1 || port > 65535 || *devname != ':') {
-        config_error(mon, "invalid vmchannel port number\n");
-        return;
+    p = config_str;
+    if (legacy_format) {
+        if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
+            goto fail_syntax;
+        }
+    } else {
+        if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
+            goto fail_syntax;
+        }
+        if (strcmp(buf, "tcp") && buf[0] != '\0') {
+            goto fail_syntax;
+        }
+        if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
+            goto fail_syntax;
+        }
+        if (buf[0] != '\0' && !inet_aton(buf, &server)) {
+            goto fail_syntax;
+        }
+        if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
+            goto fail_syntax;
+        }
+    }
+    port = strtol(buf, &end, 10);
+    if (*end != '\0' || port < 1 || port > 65535) {
+        goto fail_syntax;
     }
-    devname++;
 
-    vmc = qemu_malloc(sizeof(struct VMChannel));
-    snprintf(name, sizeof(name), "vmchannel%d", port);
-    vmc->hd = qemu_chr_open(name, devname, NULL);
-    if (!vmc->hd) {
-        config_error(mon, "could not open vmchannel device '%s'\n", devname);
-        qemu_free(vmc);
+    fwd = qemu_malloc(sizeof(struct GuestFwd));
+    snprintf(buf, sizeof(buf), "guestfwd.tcp:%d", port);
+    fwd->hd = qemu_chr_open(buf, p, NULL);
+    if (!fwd->hd) {
+        config_error(mon, "could not open guest forwarding device '%s'\n",
+                     buf);
+        qemu_free(fwd);
         return;
     }
-    vmc->port = port;
+    fwd->server = server;
+    fwd->port = port;
 
-    slirp_add_exec(3, vmc->hd, 4, port);
-    qemu_chr_add_handlers(vmc->hd, vmchannel_can_read, vmchannel_read,
-                          NULL, vmc);
+    if (slirp_add_exec(3, fwd->hd, server, port) < 0) {
+        config_error(mon, "conflicting/invalid host:port in guest forwarding "
+                     "rule '%s'\n", config_str);
+        qemu_free(fwd);
+        return;
+    }
+    qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
+                          NULL, fwd);
     return;
+
+ fail_syntax:
+    config_error(mon, "invalid guest forwarding rule '%s'\n", config_str);
 }
 
 #endif /* CONFIG_SLIRP */
@@ -2252,15 +2384,21 @@ int net_client_init(Monitor *mon, const char *device, const char *p)
 #ifdef CONFIG_SLIRP
     if (!strcmp(device, "user")) {
         static const char * const slirp_params[] = {
-            "vlan", "name", "hostname", "restrict", "ip", "tftp", "bootfile",
-            "smb", "redir", "channel", NULL
+            "vlan", "name", "hostname", "restrict", "ip", "net", "host",
+            "tftp", "bootfile", "dhcpstart", "dns", "smb", "smbserver",
+            "hostfwd", "guestfwd", NULL
         };
         struct slirp_config_str *config;
+        int restricted = 0;
+        char *vnet = NULL;
+        char *vhost = NULL;
+        char *vhostname = NULL;
         char *tftp_export = NULL;
         char *bootfile = NULL;
+        char *vdhcp_start = NULL;
+        char *vnamesrv = NULL;
         char *smb_export = NULL;
-        int restricted = 0;
-        char *ip = NULL;
+        char *vsmbsrv = NULL;
         const char *q;
 
         if (check_params(buf, sizeof(buf), slirp_params, p) < 0) {
@@ -2268,14 +2406,29 @@ int net_client_init(Monitor *mon, const char *device, const char *p)
             ret = -1;
             goto out;
         }
+        if (get_param_value(buf, sizeof(buf), "ip", p)) {
+            /* emulate legacy parameter */
+            vnet = qemu_malloc(strlen(buf) + strlen("/24") + 1);
+            strcpy(vnet, buf);
+            strcat(vnet, "/24");
+        }
+        if (get_param_value(buf, sizeof(buf), "net", p)) {
+            vnet = qemu_strdup(buf);
+        }
+        if (get_param_value(buf, sizeof(buf), "host", p)) {
+            vhost = qemu_strdup(buf);
+        }
         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
-            pstrcpy(slirp_hostname, sizeof(slirp_hostname), buf);
+            vhostname = qemu_strdup(buf);
         }
         if (get_param_value(buf, sizeof(buf), "restrict", p)) {
             restricted = (buf[0] == 'y') ? 1 : 0;
         }
-        if (get_param_value(buf, sizeof(buf), "ip", p)) {
-            ip = qemu_strdup(buf);
+        if (get_param_value(buf, sizeof(buf), "dhcpstart", p)) {
+            vdhcp_start = qemu_strdup(buf);
+        }
+        if (get_param_value(buf, sizeof(buf), "dns", p)) {
+            vnamesrv = qemu_strdup(buf);
         }
         if (get_param_value(buf, sizeof(buf), "tftp", p)) {
             tftp_export = qemu_strdup(buf);
@@ -2285,15 +2438,18 @@ int net_client_init(Monitor *mon, const char *device, const char *p)
         }
         if (get_param_value(buf, sizeof(buf), "smb", p)) {
             smb_export = qemu_strdup(buf);
+            if (get_param_value(buf, sizeof(buf), "smbserver", p)) {
+                vsmbsrv = qemu_strdup(buf);
+            }
         }
         q = p;
         while (1) {
             config = qemu_malloc(sizeof(*config));
             if (!get_next_param_value(config->str, sizeof(config->str),
-                                      "redir", &q)) {
+                                      "hostfwd", &q)) {
                 break;
             }
-            config->flags = SLIRP_CFG_REDIR;
+            config->flags = SLIRP_CFG_HOSTFWD;
             config->next = slirp_configs;
             slirp_configs = config;
             config = NULL;
@@ -2302,7 +2458,7 @@ int net_client_init(Monitor *mon, const char *device, const char *p)
         while (1) {
             config = qemu_malloc(sizeof(*config));
             if (!get_next_param_value(config->str, sizeof(config->str),
-                                      "channel", &q)) {
+                                      "guestfwd", &q)) {
                 break;
             }
             config->flags = 0;
@@ -2312,23 +2468,29 @@ int net_client_init(Monitor *mon, const char *device, const char *p)
         }
         qemu_free(config);
         vlan->nb_host_devs++;
-        ret = net_slirp_init(mon, vlan, device, name, restricted, ip,
-                             tftp_export, bootfile, smb_export);
-        qemu_free(ip);
+        ret = net_slirp_init(mon, vlan, device, name, restricted, vnet, vhost,
+                             vhostname, tftp_export, bootfile, vdhcp_start,
+                             vnamesrv, smb_export, vsmbsrv);
+        qemu_free(vnet);
+        qemu_free(vhost);
+        qemu_free(vhostname);
         qemu_free(tftp_export);
         qemu_free(bootfile);
+        qemu_free(vdhcp_start);
+        qemu_free(vnamesrv);
         qemu_free(smb_export);
+        qemu_free(vsmbsrv);
     } else if (!strcmp(device, "channel")) {
         if (!slirp_inited) {
             struct slirp_config_str *config;
 
             config = qemu_malloc(sizeof(*config));
             pstrcpy(config->str, sizeof(config->str), p);
-            config->flags = 0;
+            config->flags = SLIRP_CFG_LEGACY;
             config->next = slirp_configs;
             slirp_configs = config;
         } else {
-            vmchannel_init(mon, p);
+            slirp_guestfwd(mon, p, 1);
         }
         ret = 0;
     } else
diff --git a/qemu-options.hx b/qemu-options.hx
index d1c1539e21caf9da16ef1cd68e29976d1abf576f..da5b0ac6a503445431f966de37be0ed3440c6225 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -749,10 +749,11 @@ DEF("net", HAS_ARG, QEMU_OPTION_net,
     "-net nic[,vlan=n][,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]\n"
     "                create a new Network Interface Card and connect it to VLAN 'n'\n"
 #ifdef CONFIG_SLIRP
-    "-net user[,vlan=n][,name=str][ip=netaddr][,restrict=y|n][,hostname=host]\n"
-    "         [,tftp=dir][,bootfile=f][,redir=rule][,channel=rule]"
+    "-net user[,vlan=n][,name=str][,net=addr[/mask]][,host=addr][,restrict=y|n]\n"
+    "         [,hostname=host][,dhcpstart=addr][,dns=addr][,tftp=dir][,bootfile=f]\n"
+    "         [,hostfwd=rule][,guestfwd=rule]"
 #ifndef _WIN32
-                                                                  "[,smb=dir]\n"
+                                             "[,smb=dir[,smbserver=addr]]\n"
 #endif
     "                connect the user mode network stack to VLAN 'n', configure its\n"
     "                DHCP server and enabled optional services\n"
@@ -819,8 +820,14 @@ Connect user mode stack to VLAN @var{n} (@var{n} = 0 is the default).
 @item name=@var{name}
 Assign symbolic name for use in monitor commands.
 
-@item ip=@var{netaddr}
-Set IP network address the guest will see (default: 10.0.2.x).
+@item net=@var{addr}[/@var{mask}]
+Set IP network address the guest will see. Optionally specify the netmask,
+either in the form a.b.c.d or as number of valid top-most bits. Default is
+10.0.2.0/8.
+
+@item host=@var{addr}
+Specify the guest-visible address of the host. Default is the 2nd IP in the
+guest network, i.e. x.x.x.2.
 
 @item restrict=y|yes|n|no
 If this options is enabled, the guest will be isolated, i.e. it will not be
@@ -830,12 +837,20 @@ to the outside. This option does not affect explicitly set forwarding rule.
 @item hostname=@var{name}
 Specifies the client hostname reported by the builtin DHCP server.
 
+@item dhcpstart=@var{addr}
+Specify the first of the 16 IPs the built-in DHCP server can assign. Default
+is the 16th to 31st IP in the guest network, i.e. x.x.x.16 to x.x.x.31.
+
+@item dns=@var{addr}
+Specify the guest-visible address of the virtual nameserver. The address must
+be different from the host address. Default is the 3rd IP in the guest network,
+i.e. x.x.x.3.
+
 @item tftp=@var{dir}
 When using the user mode network stack, activate a built-in TFTP
 server. The files in @var{dir} will be exposed as the root of a TFTP server.
 The TFTP client on the guest must be configured in binary mode (use the command
-@code{bin} of the Unix TFTP client). The host IP address on the guest is
-10.0.2.2 by default.
+@code{bin} of the Unix TFTP client).
 
 @item bootfile=@var{file}
 When using the user mode network stack, broadcast @var{file} as the BOOTP
@@ -847,10 +862,11 @@ Example (using pxelinux):
 qemu -hda linux.img -boot n -net user,tftp=/path/to/tftp/files,bootfile=/pxelinux.0
 @end example
 
-@item smb=@var{dir}
+@item smb=@var{dir}[,smbserver=@var{addr}]
 When using the user mode network stack, activate a built-in SMB
 server so that Windows OSes can access to the host files in @file{@var{dir}}
-transparently.
+transparently. The IP address of the SMB server can be set to @var{addr}. By
+default the 4th IP in the guest network is used, i.e. x.x.x.4.
 
 In the guest Windows OS, the line:
 @example
@@ -865,19 +881,19 @@ Note that a SAMBA server must be installed on the host OS in
 @file{/usr/sbin/smbd}. QEMU was tested successfully with smbd versions from
 Red Hat 9, Fedora Core 3 and OpenSUSE 11.x.
 
-@item redir=[tcp|udp]:@var{host-port}:[@var{guest-host}]:@var{guest-port}
-Redirect incoming TCP or UDP connections to the host port @var{host-port} to
-the guest @var{guest-host} on guest port @var{guest-port}. If @var{guest-host}
-is not specified, its value is 10.0.2.15 (default address given by the built-in
-DHCP server). If no connection type is specified, TCP is used. This option can
-be given multiple times.
+@item hostfwd=[tcp|udp]:@var{hostport}:[@var{guestaddr}]:@var{guestport}
+Redirect incoming TCP or UDP connections to the host port @var{hostport} to
+the guest IP address @var{guestaddr} on guest port @var{guestport}. If
+@var{guestaddr} is not specified, its value is x.x.x.15 (default first address
+given by the built-in DHCP server). If no connection type is specified, TCP is
+used. This option can be given multiple times.
 
 For example, to redirect host X11 connection from screen 1 to guest
 screen 0, use the following:
 
 @example
 # on the host
-qemu -net user,redir=tcp:6001::6000 [...]
+qemu -net user,hostfwd=tcp:6001::6000 [...]
 # this host xterm should open in the guest X11 server
 xterm -display :1
 @end example
@@ -887,14 +903,14 @@ the guest, use the following:
 
 @example
 # on the host
-qemu -net user,redir=tcp:5555::23 [...]
+qemu -net user,hostfwd=tcp:5555::23 [...]
 telnet localhost 5555
 @end example
 
 Then when you use on the host @code{telnet localhost 5555}, you
 connect to the guest telnet server.
 
-@item channel=@var{port}:@var{dev}
+@item guestfwd=[tcp]:@var{server}:@var{port}-@var{dev}
 Forward guest TCP connections to port @var{port} on the host to character
 device @var{dev}. This option can be given multiple times.
 
diff --git a/slirp/libslirp.h b/slirp/libslirp.h
index 7dee34b369d28425695ad52f441e1d8125bb766c..e4c9c99c3ba2d128a3ad2c1716edb426439421dd 100644
--- a/slirp/libslirp.h
+++ b/slirp/libslirp.h
@@ -5,8 +5,11 @@
 extern "C" {
 #endif
 
-void slirp_init(int restricted, const char *special_ip, const char *tftp_path,
-                const char *bootfile);
+void slirp_init(int restricted, struct in_addr vnetwork,
+                struct in_addr vnetmask, struct in_addr vhost,
+                const char *vhostname, const char *tftp_path,
+                const char *bootfile, struct in_addr vdhcp_start,
+                struct in_addr vnameserver);
 
 void slirp_select_fill(int *pnfds,
                        fd_set *readfds, fd_set *writefds, fd_set *xfds);
@@ -19,18 +22,17 @@ void slirp_input(const uint8_t *pkt, int pkt_len);
 int slirp_can_output(void);
 void slirp_output(const uint8_t *pkt, int pkt_len);
 
-int slirp_redir_rm(int is_udp, int host_port);
-int slirp_redir(int is_udp, int host_port,
-                struct in_addr guest_addr, int guest_port);
-int slirp_add_exec(int do_pty, const void *args, int addr_low_byte,
-                   int guest_port);
+int slirp_add_hostfwd(int is_udp, int host_port,
+                      struct in_addr guest_addr, int guest_port);
+int slirp_remove_hostfwd(int is_udp, int host_port);
 
-extern char slirp_hostname[33];
+int slirp_add_exec(int do_pty, const void *args, struct in_addr guest_addr,
+                   int guest_port);
 
 void slirp_stats(void);
-void slirp_socket_recv(int addr_low_byte, int guest_port, const uint8_t *buf,
-		int size);
-size_t slirp_socket_can_recv(int addr_low_byte, int guest_port);
+void slirp_socket_recv(struct in_addr guest_addr, int guest_port,
+                       const uint8_t *buf, int size);
+size_t slirp_socket_can_recv(struct in_addr guest_addr, int guest_port);
 
 #ifdef __cplusplus
 }
diff --git a/slirp/main.h b/slirp/main.h
index edbb9cb39a47638364322e62d3fd28395d1b64c1..891220ae91bd4ca13da6e293a6ec8ffc38662ee9 100644
--- a/slirp/main.h
+++ b/slirp/main.h
@@ -47,6 +47,7 @@ extern int ppp_exit;
 extern int tcp_keepintvl;
 extern uint8_t client_ethaddr[6];
 extern int slirp_restrict;
+extern char slirp_hostname[33];
 extern char *tftp_prefix;
 extern char *bootp_filename;
 
diff --git a/slirp/slirp.c b/slirp/slirp.c
index 8affd46c7c3313cb0b3d4f6200094ae45bb90948..a91823203416973be278323522cf3119bae7fd7e 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -173,12 +173,14 @@ static void slirp_cleanup(void)
 static void slirp_state_save(QEMUFile *f, void *opaque);
 static int slirp_state_load(QEMUFile *f, void *opaque, int version_id);
 
-void slirp_init(int restricted, const char *special_ip, const char *tftp_path,
-                const char *bootfile)
+void slirp_init(int restricted, struct in_addr vnetwork,
+                struct in_addr vnetmask, struct in_addr vhost,
+                const char *vhostname, const char *tftp_path,
+                const char *bootfile, struct in_addr vdhcp_start,
+                struct in_addr vnameserver)
 {
     //    debug_init("/tmp/slirp.log", DEBUG_DEFAULT);
 
-    struct in_addr special_addr = { .s_addr = htonl(0x0a000200) };
 #ifdef _WIN32
     WSADATA Data;
 
@@ -203,8 +205,11 @@ void slirp_init(int restricted, const char *special_ip, const char *tftp_path,
         fprintf (stderr, "Warning: No DNS servers found\n");
     }
 
-    if (special_ip) {
-        inet_aton(special_ip, &special_addr);
+    vnetwork_addr = vnetwork;
+    vnetwork_mask = vnetmask;
+    vhost_addr = vhost;
+    if (vhostname) {
+        pstrcpy(slirp_hostname, sizeof(slirp_hostname), vhostname);
     }
     qemu_free(tftp_prefix);
     tftp_prefix = NULL;
@@ -216,12 +221,9 @@ void slirp_init(int restricted, const char *special_ip, const char *tftp_path,
     if (bootfile) {
         bootp_filename = qemu_strdup(bootfile);
     }
+    vdhcp_startaddr = vdhcp_start;
+    vnameserver_addr = vnameserver;
 
-    vnetwork_addr = special_addr;
-    vnetwork_mask.s_addr = htonl(0xffffff00);
-    vhost_addr.s_addr = special_addr.s_addr | htonl(2);
-    vdhcp_startaddr.s_addr = special_addr.s_addr | htonl(15);
-    vnameserver_addr.s_addr = special_addr.s_addr | htonl(3);
     getouraddr();
     register_savevm("slirp", 0, 1, slirp_state_save, slirp_state_load, NULL);
 }
@@ -755,7 +757,7 @@ void if_encap(const uint8_t *ip_data, int ip_data_len)
 /* Unlistens a redirection
  *
  * Return value: number of redirs removed */
-int slirp_redir_rm(int is_udp, int host_port)
+int slirp_remove_hostfwd(int is_udp, int host_port)
 {
     struct socket *so;
     struct socket *head = (is_udp ? &udb : &tcb);
@@ -775,8 +777,8 @@ int slirp_redir_rm(int is_udp, int host_port)
     return n;
 }
 
-int slirp_redir(int is_udp, int host_port,
-                struct in_addr guest_addr, int guest_port)
+int slirp_add_hostfwd(int is_udp, int host_port,
+                      struct in_addr guest_addr, int guest_port)
 {
     if (!guest_addr.s_addr) {
         guest_addr = vdhcp_startaddr;
@@ -793,13 +795,13 @@ int slirp_redir(int is_udp, int host_port,
     return 0;
 }
 
-int slirp_add_exec(int do_pty, const void *args, int addr_low_byte,
-                  int guest_port)
+int slirp_add_exec(int do_pty, const void *args, struct in_addr guest_addr,
+                   int guest_port)
 {
-    struct in_addr guest_addr = {
-        .s_addr = vnetwork_addr.s_addr | htonl(addr_low_byte)
-    };
-
+    if (!guest_addr.s_addr) {
+        guest_addr.s_addr =
+            vnetwork_addr.s_addr | (htonl(0x0204) & ~vnetwork_mask.s_addr);
+    }
     if ((guest_addr.s_addr & vnetwork_mask.s_addr) != vnetwork_addr.s_addr ||
         guest_addr.s_addr == vhost_addr.s_addr ||
         guest_addr.s_addr == vnameserver_addr.s_addr) {
@@ -833,11 +835,8 @@ slirp_find_ctl_socket(struct in_addr guest_addr, int guest_port)
     return NULL;
 }
 
-size_t slirp_socket_can_recv(int addr_low_byte, int guest_port)
+size_t slirp_socket_can_recv(struct in_addr guest_addr, int guest_port)
 {
-    struct in_addr guest_addr = {
-        .s_addr = vnetwork_addr.s_addr | htonl(addr_low_byte)
-    };
 	struct iovec iov[2];
 	struct socket *so;
 
@@ -855,13 +854,10 @@ size_t slirp_socket_can_recv(int addr_low_byte, int guest_port)
 	return sopreprbuf(so, iov, NULL);
 }
 
-void slirp_socket_recv(int addr_low_byte, int guest_port, const uint8_t *buf,
-        int size)
+void slirp_socket_recv(struct in_addr guest_addr, int guest_port,
+                       const uint8_t *buf, int size)
 {
     int ret;
-    struct in_addr guest_addr = {
-        .s_addr = vnetwork_addr.s_addr | htonl(addr_low_byte)
-    };
     struct socket *so = slirp_find_ctl_socket(guest_addr, guest_port);
 
     if (!so)