diff --git a/files/offloader_vm_net_up b/files/offloader_vm_net_up
new file mode 100755
index 0000000..db6d97c
--- /dev/null
+++ b/files/offloader_vm_net_up
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -e
+
+# tap0 -> clients (vlan: 2)
+# tap1 -> wan     (vlan: 3)
+
+VLAN=2
+BRIDGE=switch
+
+ifname=$1
+
+[ $ifname = "tap1" ] && VLAN=3
+
+# associate tap interface with bridge
+ip link set dev $ifname up
+ip link set dev $ifname master $BRIDGE
+
+# delete standard vlan
+bridge vlan del dev $ifname vid 1
+
+# correctly tag interface
+bridge vlan add dev $ifname vid $VLAN pvid untagged
diff --git a/playbook_provision_gateway.yml b/playbook_provision_gateway.yml
index 62bf1a8..cec1555 100644
--- a/playbook_provision_gateway.yml
+++ b/playbook_provision_gateway.yml
@@ -68,3 +68,68 @@
       service:
         name: frr
         state: restarted
+
+- name: custom changes for ffl-ans-gw-core01 (offloader vm, ...)
+  hosts: ffl-ans-gw-core01
+  tasks:
+    - name: install qemu packages
+      opkg:
+        name:
+          - kmod-tun
+          - qemu-x86_64-softmmu
+          - kmod-kvm-intel
+        update_cache: yes
+
+    - name: deploy qemu network hook
+      copy:
+        src: files/offloader_vm_net_up
+        dest: /root/offloader_vm_net_up
+        owner: root
+        group: root
+        mode: 0755
+
+    - name: provision /etc/init.d
+      template:
+        src: "{{ item }}"
+        dest: /etc/init.d/
+        owner: root
+        group: root
+        mode: 0755
+      with_fileglob:
+        - "templates/gateways/{{ inventory_hostname }}/etc/init.d/*"
+
+    - name: preserve custom changes on config backups
+      blockinfile:
+        path: /etc/sysupgrade.conf
+        marker_begin: "BEGIN OFFLOADER"
+        marker_end: "END OFFLOADER"
+        block: |
+          /etc/init.d/qemu-offloader
+          /root/offloader_vm_net_up
+
+    - name: enable offloader vm service
+      service:
+        name: qemu-offloader
+        state: started
+        enabled: True
+
+    - name: add notes about custom offloader in banner
+      copy:
+        dest: /etc/profile.d/01_offloader_banner.sh
+        owner: root
+        group: root
+        mode: 0644
+        content: |
+          cat << EOB
+           DISCLAIMER:
+           ===========
+           There is a FFL/FFDD offloader running on this machine
+           via qemu.
+
+           service qemu-offloader status
+
+           to be cleaned up:
+           - let procd gracefully kill the vm on stop/shutdown
+           - remove network hook /root/offloader_vm_net_up
+           -----------------------------------------------------
+          EOB
diff --git a/templates/gateways/ffl-ans-gw-core01/etc/init.d/qemu-offloader b/templates/gateways/ffl-ans-gw-core01/etc/init.d/qemu-offloader
new file mode 100755
index 0000000..ba6a1b8
--- /dev/null
+++ b/templates/gateways/ffl-ans-gw-core01/etc/init.d/qemu-offloader
@@ -0,0 +1,50 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2013-2017 OpenWrt.org
+
+START=99
+USE_PROCD=1
+
+start_service() {
+
+	procd_open_instance
+
+	procd_set_param command qemu-system-x86_64
+	procd_append_param command -enable-kvm
+	procd_append_param command -cpu host
+	procd_append_param command -smp 2
+	procd_append_param command -m 1G
+	procd_append_param command -machine type=q35,accel=kvm
+	procd_append_param command -drive file=/dev/sdb,cache=none,if=virtio,format=raw
+	procd_append_param command -nic tap,model=virtio-net-pci,script=/root/offloader_vm_net_up,downscript=no,ifname=tap0
+	procd_append_param command -nic tap,model=virtio-net-pci,script=/root/offloader_vm_net_up,downscript=no,ifname=tap1
+	procd_append_param command -pidfile /var/run/qemu-offloader.pid
+	procd_append_param command -chardev socket,path=/tmp/qga.qemu-offloader.sock,server=on,wait=off,id=qga0
+	procd_append_param command -device virtio-serial
+	procd_append_param command -device virtserialport,chardev=qga0,name=org.qemu.guest_agent.0
+
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_set_param respawn
+
+	procd_close_instance
+}
+
+#stop_service() {
+#	[ ! -e /tmp/qga.sock ] && exit 0
+#	echo "sending shutdown command via guest agent"
+#	socat stdio unix-connect:/tmp/qga.sock << EOF
+#{"execute":"guest-shutdown"}
+#EOF
+#}
+#
+#service_stopped() {
+#	for i in $(seq 1 20)
+#	do
+#		if [ ! -e /var/run/qemu-alpine.pid ]; then
+#			echo "vm down !"
+#			exit 0
+#		fi
+#		echo "vm not down yet"
+#		sleep 1
+#	done
+#}