diff --git a/usr/local/share/bastille/common.sh b/usr/local/share/bastille/common.sh
index 1295799a..e2fd8f22 100644
--- a/usr/local/share/bastille/common.sh
+++ b/usr/local/share/bastille/common.sh
@@ -94,6 +94,9 @@ generate_vnet_jail_netblock() {
         local uniq_epair="bastille0"
         local uniq_epair_bridge="0"
     fi
+    # generate static MAC for jail using host prefix (first half of host MAC)
+    local host_mac_prefix="$(ifconfig ${external_interface} | grep ether | awk '{print $2}' | cut -d':' -f1-3)"
+	local jail_mac_suffix="$(echo -n ${jail_name} | sha256 | tr -d '\n' | awk '{print substr($0,length($0)-5,2) ":" substr($0,length($0)-3,2) ":" substr($0,length($0)-1,1)}')"
     if [ -n "${use_unique_bridge}" ]; then
         ## generate bridge config
         cat <<-EOF
@@ -103,6 +106,8 @@ generate_vnet_jail_netblock() {
   exec.prestart += "ifconfig ${external_interface} addm epair${uniq_epair_bridge}a";
   exec.prestart += "ifconfig epair${uniq_epair_bridge}a up name e${uniq_epair_bridge}a_${jail_name}";
   exec.prestart += "ifconfig epair${uniq_epair_bridge}b up name e${uniq_epair_bridge}b_${jail_name}";
+  exec.prestart += "ifconfig e${uniq_epair_bridge}a_${jail_name} ether ${host_mac_prefix}:${jail_mac_suffix}a";
+  exec.prestart += "ifconfig e${uniq_epair_bridge}b_${jail_name} ether ${host_mac_prefix}:${jail_mac_suffix}b";
   exec.poststop += "ifconfig ${external_interface} deletem e${uniq_epair_bridge}a_${jail_name}";
   exec.poststop += "ifconfig e${uniq_epair_bridge}a_${jail_name} destroy";
 EOF