Maybe I'm missing something, but it looks like hostfwd_add doesn't fully work with -netdev.
Command definition from hmp-commands.hx: { .name = "hostfwd_add", .args_type = "arg1:s,arg2:s?,arg3:s?", .params = "[vlan_id name] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport", .help = "redirect TCP or UDP connections from host to guest (requires -net user)", .mhandler.cmd = net_slirp_hostfwd_add, }, Note: params says command takes either 1 or 3 arguments. args_type can't express that, so it asks for 1-3. Command handler: void net_slirp_hostfwd_add(Monitor *mon, const QDict *qdict) { const char *redir_str; SlirpState *s; const char *arg1 = qdict_get_str(qdict, "arg1"); const char *arg2 = qdict_get_try_str(qdict, "arg2"); const char *arg3 = qdict_get_try_str(qdict, "arg3"); if (arg2) { s = slirp_lookup(mon, arg1, arg2); redir_str = arg3; } else { s = slirp_lookup(mon, NULL, NULL); redir_str = arg1; } if (s) { slirp_hostfwd(s, redir_str, 0); } } If I understand the code correctly, the command has the following forms: * hostfwd_add REDIR This form uses the default stack (first member of slirp_stacks). Seems to work okay with -netdev: $ qemu-system-x86_64 --nodefaults --enable-kvm -vnc :0 -S -m 384 -monitor stdio -netdev user,id=net.0 -device virtio-net-pci,netdev=net.0,id=nic.0 QEMU 0.15.92 monitor - type 'help' for more information (qemu) hostfwd_add tcp::12345-:22 (qemu) info usernet VLAN -1 (net.0): Protocol[State] FD Source Address Port Dest. Address Port RecvQ SendQ TCP[HOST_FORWARD] 12 * 12345 10.0.2.15 22 0 0 * hostfwd_add VLAN STACK REDIR This form was added in commit f13b572c "slirp: Make hostfwd_add/remove multi-instance-aware". I don't like how it overloads the command; adding the optional arguments at the end would have been cleaner. Water under the bridge. Note that slirp_lookup() converts VLAN to an int (without error checking, i.e. non-integers are silently interpreted as zero, integers out of bounds are silently truncated). Anyway, I can't make it work with -netdev: (qemu) hostfwd_add -1 net.0 tcp::12345-:22 unknown VLAN -1 * Just for giggles: what if I give two arguments? $ qemu-system-x86_64--nodefaults --enable-kvm -vnc :0 -S -m 384 -monitor stdio -net user -device virtio-net-pci,id=nic.0,vlan=0QEMU 0.15.92 monitor - type 'help' for more information (qemu) hostfwd_add 0 user.0 invalid host forwarding rule '(null)' The (null) is from a printf-like function printing a null pointer with conversion %s. Crash bug on some systems.