diff --git a/docker-compose.yml b/docker-compose.yml
index 685853f..ec7590c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -11,16 +11,16 @@ services:
       # Define number of VM CPUs
       CPU_COUNT: 2
 
-      # If WAN interface is not specified the Docker network
-      # In this case a port forwarding from port OpenWrt 80 to port 8000 is available
+      # Define which physical or virtual interfaces shall be attach direct to OpenWrt
       #WAN_IF: "enx00e04c0407a6"
       #LAN_IF: "enx00e04d68033f"
+      LAN_IF: "veth" # veth pair between OpenWrt and host system
 
       # USB passthrough
       # Format <vendorID>:<productID> like 'lsusb' is given
       # Currently only one USB device is supported
-      USB_VID_1: "0e8d" # vendor ID
-      USB_PID_1: "7961" # product ID
+      #USB_VID_1: "0e8d" # vendor ID
+      #USB_PID_1: "7961" # product ID
 
     ports:
       # Port 8006 is console tty web VNC
diff --git a/readme.md b/readme.md
index 7f05817..ccb0ba5 100644
--- a/readme.md
+++ b/readme.md
@@ -8,7 +8,8 @@ Images can be found a docker hub https://hub.docker.com/r/albrechtloh/qemu-openw
 
  - KVM acceleration
  - Web-based viewer for tty console
- - Attaches two physical Ethernet interfaces exclusively into the docker container
+ - Attaches two physical Ethernet interfaces (LAN/WAN) exclusively into the docker container
+ - Create virtual LAN between OpenWrt and host system (LAN only)
  - USB passthrough e.g. for modem or Wi-Fi
  - Automatic config migration when OpenWrt is updated (experimental)
 
diff --git a/src/run_openwrt.sh b/src/run_openwrt.sh
index 4244eea..e0e04dd 100755
--- a/src/run_openwrt.sh
+++ b/src/run_openwrt.sh
@@ -12,6 +12,7 @@ trap - ERR
 VERS=$(qemu-system-aarch64 --version | head -n 1 | cut -d '(' -f 1)
 FILE=/storage/rootfs-${OPENWRT_IMAGE_ID}.img
 
+# Attach physical interfaces to Docker container
 attach_eth_if () {
   HOST_IF=$1
   CONTAINER_IF=$2
@@ -51,6 +52,38 @@ attach_eth_if () {
   #ip link set $QEMU_IF up
 }
 
+# Create veth pairs between host system and Docker container
+attach_veth_if () {
+  VETH_IF_HOST=$1
+  VETH_IF_CONTAINER=$2
+  QEMU_IF=$3
+
+  info "Creating virtual Ethernet interfaces pairs between host system ($VETH_IF_HOST) and container ($VETH_IF_CONTAINER)..."
+
+  if ! nsenter --target 1 --uts --net --ipc --mount ip link show "$VETH_IF_HOST" &> /dev/null; then
+    # Create veth pair
+    nsenter --target 1 --uts --net --ipc --mount ip link add $VETH_IF_HOST type veth peer name $VETH_IF_CONTAINER
+    nsenter --target 1 --uts --net --ipc --mount ip link set $VETH_IF_HOST up
+  else
+    info "Virtual Ethernet interface $VETH_IF_HOST already exists. Assuming pairs is already created."
+  fi
+
+  if ! nsenter --target 1 --uts --net --ipc --mount ip link show "$VETH_IF_CONTAINER" &> /dev/null; then
+    #info "OpenWrt virtual Ethernet interface $VETH_IF_CONTAINER does not exists. It can be a wrong interface name or the Ethernet interface is already assigend to this container."
+    return
+  fi
+
+  # Put second pair into container
+  PID_CONTAINTER=$(nsenter --target 1 --uts --net --ipc --mount docker inspect -f '{{.State.Pid}}' $(cat /etc/hostname))
+  nsenter --target 1 --uts --net --ipc --mount mkdir -p /var/run/netns
+  nsenter --target 1 --uts --net --ipc --mount ln -s /proc/$PID_CONTAINTER/ns/net /var/run/netns/$PID_CONTAINTER
+  nsenter --target 1 --uts --net --ipc --mount ip link set $VETH_IF_CONTAINER netns $PID_CONTAINTER
+  nsenter --target 1 --uts --net --ipc --mount ip netns exec $PID_CONTAINTER ip link set $VETH_IF_CONTAINER up
+  nsenter --target 1 --uts --net --ipc --mount rm /var/run/netns/$PID_CONTAINTER
+
+  ip link add link $VETH_IF_CONTAINER name $QEMU_IF type macvtap mode passthru
+  ip link set $QEMU_IF up
+}
 
 # Check KVM
 info "Checking for KVM ..."
@@ -74,6 +107,11 @@ fi
 LAN_ARGS=""
 if [[ -z "${LAN_IF}" ]]; then
   LAN_ARGS="-device virtio-net,netdev=qlan0 -netdev user,id=qlan0,net=192.168.1.0/24"
+elif [[ $LAN_IF = "veth" ]]; then
+  attach_veth_if veth-openwrt0 veth1 qlan1
+  exec 30<>/dev/tap$(cat /sys/class/net/qlan1/ifindex)
+  LAN_ARGS="-device virtio-net-pci,netdev=hostnet0,mac=$(cat /sys/class/net/qlan1/address) \
+    -netdev tap,fd=30,id=hostnet0"
 else
   HOST_LAN_IF=$LAN_IF
   attach_eth_if $HOST_LAN_IF $HOST_LAN_IF qlan0