diff --git a/emhttp/plugins/dynamix.docker.manager/DockerSettings.page b/emhttp/plugins/dynamix.docker.manager/DockerSettings.page
index f33437337..79f593ab3 100644
--- a/emhttp/plugins/dynamix.docker.manager/DockerSettings.page
+++ b/emhttp/plugins/dynamix.docker.manager/DockerSettings.page
@@ -23,6 +23,8 @@ require_once "$docroot/plugins/dynamix.docker.manager/include/DockerClient.php";
 $DockerClient  = new DockerClient();
 exec("/etc/rc.d/rc.docker status >/dev/null",$dummy,$DockerStopped);
 
+$bridge = file_exists('/sys/class/net/br0');
+
 function strposX($s, $c, $n=1) {
   $p = 0;
   while ($n && $p=strpos($s,$c,$p)!==false) {$n--; $p+=strlen($c);}
@@ -254,6 +256,16 @@ _(Template Authoring Mode)_:
 
 :docker_authoring_mode_help:
 
+<?if ($bridge):?>
+_(Docker custom network type)_:
+: <select name="DOCKER_NETWORK_TYPE">
+  <?=mk_option(_var($dockercfg,'DOCKER_NETWORK_TYPE'), '1', _('ipvlan'))?>
+  <?=mk_option(_var($dockercfg,'DOCKER_NETWORK_TYPE'), '', _('macvlan'))?>
+  </select>&nbsp;_(Please read the Help carefully)_.  _(Misconfiguration can cause problems)_.
+
+:docker_custom_network_type_help:
+
+<?endif;?>
 _(Host access to custom networks)_:
 : <select name="DOCKER_ALLOW_ACCESS">
   <?=mk_option(_var($dockercfg,'DOCKER_ALLOW_ACCESS'), '', _('Disabled'))?>
@@ -452,6 +464,13 @@ _(Docker LOG rotation)_:
 
 :docker_log_rotation_active_help:
 
+<?if ($bridge):?>
+_(Docker custom network type)_:
+: <?=_var($dockercfg,'DOCKER_NETWORK_TYPE')=='1' ? _('ipvlan') : _('macvlan')?>
+
+:docker_custom_network_type_help:
+
+<?endif;?>
 _(Host access to custom networks)_:
 : <?=_var($dockercfg,'DOCKER_ALLOW_ACCESS')=='yes' ? _('Enabled') : _('Disabled')?>
 
diff --git a/emhttp/plugins/dynamix.vm.manager/include/libvirt.php b/emhttp/plugins/dynamix.vm.manager/include/libvirt.php
index b359871ce..84ac4a502 100644
--- a/emhttp/plugins/dynamix.vm.manager/include/libvirt.php
+++ b/emhttp/plugins/dynamix.vm.manager/include/libvirt.php
@@ -661,7 +661,7 @@
 					$netmodel = $nic['model'] ?: 'virtio-net';
 
 					$net_res =$this->libvirt_get_net_res($this->conn, $nic['network']);
-					$vhost = file_exists("/boot/config/network.cfg") && exec("grep -Po '^BRNICS\\[0\\]=\"\\K[^\"]+' /boot/config/network.cfg")=='';
+					$vhost = !file_exists('/sys/class/net/br0');
 					if ($vhost) {
 						exec("ip -br a|grep -Po '^vhost[0-9][^@]*'",$br);
 					} else {
diff --git a/emhttp/plugins/dynamix.vm.manager/include/libvirt_helpers.php b/emhttp/plugins/dynamix.vm.manager/include/libvirt_helpers.php
index 8f7d643e8..c7bc6e208 100644
--- a/emhttp/plugins/dynamix.vm.manager/include/libvirt_helpers.php
+++ b/emhttp/plugins/dynamix.vm.manager/include/libvirt_helpers.php
@@ -1066,10 +1066,10 @@ private static $encoding = 'UTF-8';
 	function getValidNetworks() {
 		global $lv;
 		$arrValidNetworks = [];
-		if (file_exists("/boot/config/network.cfg") && exec("grep -Pom1 '^BRNICS\\[0\\]=\"\\K[^\"]+' /boot/config/network.cfg")=='') {
-			exec("ip -br a|grep -Po '^(virbr|vhost)[0-9][^@ ]*'",$arrBridges);
-		} else {
+		if (file_exists('/sys/class/net/br0')) {
 			exec("brctl show|grep -Po '^(vir)?br[0-9]+(\.[0-9]+)?'", $arrBridges);
+		} else {
+			exec("ip -br a|grep -Po '^(virbr|vhost)[0-9][^@ ]*'",$arrBridges);
 		}
 		if (!is_array($arrBridges)) {
 			$arrBridges = [];
diff --git a/etc/rc.d/rc.docker b/etc/rc.d/rc.docker
index 77a23b52d..97cf93611 100755
--- a/etc/rc.d/rc.docker
+++ b/etc/rc.d/rc.docker
@@ -77,9 +77,23 @@ else
   [[ -e $SYSTEM/docker0 ]] && echo 1 > $CONF6/docker0/disable_ipv6
 fi
 
-DETACH='ipvlan'
-ATTACH='macvlan'
-MODE='bridge'
+# user selection when bridge is enabled
+if [[ -z $DOCKER_NETWORK_TYPE ]]; then
+  DETACH='ipvlan'
+  ATTACH='macvlan'
+  MODE='bridge'
+else
+  DETACH='macvlan'
+  ATTACH='ipvlan'
+  MODE='l2 bridge'
+fi
+
+# fixed selection when bridge is disabled
+if [[ $PORT != br0 ]]; then
+  DETACH='ipvlan'
+  ATTACH='macvlan'
+  MODE='bridge'
+fi
 
 export DOCKER_RAMDISK=true
 
@@ -246,7 +260,7 @@ start_network(){
       MY_NETWORK= MY_IP=
       while read_dom; do
         [[ $ENTITY == Network ]] && MY_NETWORK=$CONTENT
-        [[ $ENTITY == MyIP ]] && MY_IP=${CONTENT// /,} && MY_IP=$(echo "$MY_IP" | tr -s "," ";")
+        [[ $ENTITY == MyIP ]] && MY_IP=${CONTENT// /,} && MY_IP=$(echo "$MY_IP"|tr -s "," ";")
       done <$XMLFILE
       # only restore valid networks
       if [[ -n $MY_NETWORK ]]; then
@@ -414,8 +428,8 @@ start_network(){
           [[ -n $RANGE ]] && SERVER="--aux-address=server=${R4%/*}" || SERVER="--aux-address=server=${SHIM_HIGH%/*}"
         fi
       fi
-      VHOST=vhost${NETWORK//[^0-9.]/}
-      docker network create -d $ATTACH $SUBNET $GATEWAY $SERVER $RANGE $SUBNET6 $GATEWAY6 $SERVER6 $RANGE6 -o parent=$VHOST $NETWORK | xargs docker network inspect -f 'created network {{.Name}} with subnets: {{range .IPAM.Config}}{{.Subnet}}; {{end}}' 2>/dev/null | logger -t $(basename $0)
+      [[ ${NETWORK:0:2} == br ]] && VHOST=$NETWORK || VHOST=vhost${NETWORK//[^0-9.]/}
+      docker network create -d $ATTACH $SUBNET $GATEWAY $SERVER $RANGE $SUBNET6 $GATEWAY6 $SERVER6 $RANGE6 -o parent=$VHOST $NETWORK | xargs docker network inspect -f "created network $ATTACH {{.Name}} with subnets: {{range .IPAM.Config}}{{.Subnet}}; {{end}}" 2>/dev/null | logger -t $(basename $0)
       # connect containers to this new network
       for CONNECT in ${NETRESTORE[$NETWORK]}; do
         CONTAINER=${CONNECT%,*}
diff --git a/etc/rc.d/rc.inet1 b/etc/rc.d/rc.inet1
index ae8ac31c2..bf244a41d 100755
--- a/etc/rc.d/rc.inet1
+++ b/etc/rc.d/rc.inet1
@@ -431,7 +431,7 @@ if_up(){
   [[ -n ${BONDNICS[$i]} ]] && bond_up  # create interface as bond
   [[ -n ${VLANS[$i]} ]] && vlan_up     # create interface VLANs
   [[ -n ${BRNICS[$i]} ]] && br_up      # create interface as bridge
-  macvtap_up                           # create macvtap interfaces
+  [[ -z ${BRNICS[$i]} ]] && macvtap_up # create macvtap interfaces
   # if the interface isn't in the kernel yet
   # but there's an alias for it in modules.conf
   # then it should be loaded first
@@ -530,7 +530,7 @@ if_down(){
       [[ $DEBUG_ETH_UP == yes ]] && log "interface $IFACE not present, can't take down"
     fi
   done
-  macvtap_down                           # delete macvtap interfaces
+  [[ -z ${BRNICS[$i]} ]] && macvtap_down # delete macvtap interfaces
   [[ -n ${BRNICS[$i]} ]] && br_down      # delete interface as bridge
   [[ -n ${VLANS[$i]} ]] && vlan_down     # delete interface VLANs
   [[ -n ${BONDNICS[$i]} ]] && bond_down  # delete interface as bond