diff --git a/packages/falter-berlin-bbbdigger/Makefile b/packages/falter-berlin-bbbdigger/Makefile
index 9d44026e..9251ab2a 100644
--- a/packages/falter-berlin-bbbdigger/Makefile
+++ b/packages/falter-berlin-bbbdigger/Makefile
@@ -8,8 +8,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=falter-berlin-bbbdigger
-PKG_VERSION:=0.0.3
-PKG_RELEASE:=3
+PKG_VERSION:=0.0.4
+PKG_RELEASE:=4
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)
 
diff --git a/packages/falter-berlin-bbbdigger/files/postinst.sh b/packages/falter-berlin-bbbdigger/files/postinst.sh
index 11528b1d..525daf00 100755
--- a/packages/falter-berlin-bbbdigger/files/postinst.sh
+++ b/packages/falter-berlin-bbbdigger/files/postinst.sh
@@ -8,6 +8,9 @@
 #
 # All other config sections are overwritten with current settings
 
+# shellcheck disable=SC2034
+
+# shellcheck source=/dev/null
 . /lib/functions.sh
 
 TUNNEL_SRV='_bbb-vpn._udp.berlin.freifunk.net'
@@ -21,7 +24,7 @@ if [ $? -eq 1 ]; then
   # start with b6 for Berliner 6ackbone
   MAC="b6"
   for byte in 2 3 4 5 6; do
-    MAC=$MAC`dd if=/dev/urandom bs=1 count=1 2> /dev/null | hexdump -e '1/1 ":%02x"'`
+    MAC=$MAC$(dd if=/dev/urandom bs=1 count=1 2> /dev/null | hexdump -e '1/1 ":%02x"')
   done
 fi
 
@@ -29,7 +32,7 @@ UUID=$(uci -q get tunneldigger.${IFACE}.uuid)
 if [ $? -eq 1 ]; then
   UUID=$MAC
   for byte in 7 8 9 10; do
-    UUID=$UUID`dd if=/dev/urandom bs=1 count=1 2> /dev/null | hexdump -e '1/1 ":%02x"'`
+    UUID=$UUID$(dd if=/dev/urandom bs=1 count=1 2> /dev/null | hexdump -e '1/1 ":%02x"')
   done
 fi
 
@@ -38,7 +41,7 @@ uci set tunneldigger.$IFACE=broker
 # remove old address list in favor of srv
 uci -q delete tunneldigger.$IFACE.address
 uci set tunneldigger.$IFACE.srv=$TUNNEL_SRV
-uci set tunneldigger.$IFACE.uuid=$UUID
+uci set tunneldigger.$IFACE.uuid="$UUID"
 uci set tunneldigger.$IFACE.interface=$IFACE
 uci set tunneldigger.$IFACE.broker_selection=usage
 uci set tunneldigger.$IFACE.bind_interface=$BIND
@@ -46,7 +49,7 @@ uci set tunneldigger.$IFACE.enabled=1
 
 # network setup
 uci set network.${IFACE}_dev=device
-uci set network.${IFACE}_dev.macaddr=$MAC
+uci set network.${IFACE}_dev.macaddr="$MAC"
 uci set network.${IFACE}_dev.name=$IFACE
 
 uci set network.$IFACE=interface
@@ -59,7 +62,7 @@ uci -q add_list firewall.zone_freifunk.network=$IFACE
 
 # olsr setup (first remove it and add it again)
 SECTION=$(uci show olsrd | grep ${IFACE} | cut -d . -f 1-2)
-[ ! -z $SECTION ] && uci delete $SECTION
+[ -n "$SECTION" ] && uci delete "$SECTION"
 uci add olsrd Interface
 uci set olsrd.@Interface[-1].ignore=0
 uci set olsrd.@Interface[-1].interface=$IFACE
diff --git a/packages/falter-berlin-migration/Makefile b/packages/falter-berlin-migration/Makefile
index e6012bd9..1a7aa198 100644
--- a/packages/falter-berlin-migration/Makefile
+++ b/packages/falter-berlin-migration/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=falter-berlin-migration
-PKG_VERSION:=9
+PKG_VERSION:=2022.08.29
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)
 
diff --git a/packages/falter-berlin-migration/files/lib/functions/semver.sh b/packages/falter-berlin-migration/files/lib/functions/semver.sh
index a605d83e..b155f084 100755
--- a/packages/falter-berlin-migration/files/lib/functions/semver.sh
+++ b/packages/falter-berlin-migration/files/lib/functions/semver.sh
@@ -1,5 +1,9 @@
 #!/usr/bin/env sh
 
+# don't care for shellcheck here, as this is a third party-lib. The
+# author probably knows better, what he was doing.
+# shellcheck disable=all
+
 # Copyright (c) 2013, Ray Bejjani
 # All rights reserved.
 #
diff --git a/packages/falter-berlin-network-defaults/Makefile b/packages/falter-berlin-network-defaults/Makefile
index aee87829..035a564c 100644
--- a/packages/falter-berlin-network-defaults/Makefile
+++ b/packages/falter-berlin-network-defaults/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=falter-berlin-network-defaults
-PKG_VERSION:=4
+PKG_VERSION:=5
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/packages/falter-berlin-network-defaults/hotplug.d/iface/60-ffuplink_policyrouting b/packages/falter-berlin-network-defaults/hotplug.d/iface/60-ffuplink_policyrouting
index 2aaf2f82..91e9319a 100755
--- a/packages/falter-berlin-network-defaults/hotplug.d/iface/60-ffuplink_policyrouting
+++ b/packages/falter-berlin-network-defaults/hotplug.d/iface/60-ffuplink_policyrouting
@@ -1,5 +1,9 @@
 #!/bin/sh
 
+# vars get assigned by config_get, which shellcheck can't recognize...
+# shellcheck disable=SC2154
+
+# shellcheck source=/dev/null
 . /lib/functions.sh
 . /lib/functions/network.sh
 
@@ -19,20 +23,20 @@ config_get zones pr zones
 if [ "$ACTION" = ifup ]; then
   logger -t ff-userlog "ffuplink interface is up"
   logger -t ff-userlog "creating ffuplink ip-rules"
-  ifaces=$(uci -q get firewall.zone_freifunk.network) 
+  ifaces=$(uci -q get firewall.zone_freifunk.network)
   network_get_subnet uplink_net ffuplink
-  if [ -z $uplink_net ]; then
+  if [ -z "$uplink_net" ]; then
     logger -t ff-userlog "UCI did not return a valid IP-net for ffuplink; querying directly with ip-tool"
     uplink_net=$(ip -4 -o addr show dev ffuplink|awk '{print $4}')
   fi
-  if [ -z $uplink_net ]; then
+  if [ -z "$uplink_net" ]; then
     logger -t ff-userlog "no valid IP-net found for ffuplink; TRAFFIC FOR UPLINK-NETWORK WILL NOT BE BLOCKED"
   fi
-  eval $(/bin/ipcalc.sh $uplink_net)
+  eval "$(/bin/ipcalc.sh "$uplink_net")"
   for iface in $ifaces; do
-    network_get_physdev netdev $iface
-    [ ! '0.0.0.0' = $NETWORK ] && ip rule add prio 19989 to $NETWORK/$PREFIX iif $netdev prohibit
-    ip rule add prio 19990 iif $netdev lookup ffuplink
+    network_get_physdev netdev "$iface"
+    [ ! '0.0.0.0' = "$NETWORK" ] && ip rule add prio 19989 to "$NETWORK/$PREFIX" iif "$netdev" prohibit
+    ip rule add prio 19990 iif "$netdev" lookup ffuplink
   done
   logger -t ff-userlog "ffuplink-interface is setup"
 fi
diff --git a/packages/falter-berlin-network-defaults/lib/functions/freifunk-berlin-network.sh b/packages/falter-berlin-network-defaults/lib/functions/freifunk-berlin-network.sh
index de01c2e5..003af491 100644
--- a/packages/falter-berlin-network-defaults/lib/functions/freifunk-berlin-network.sh
+++ b/packages/falter-berlin-network-defaults/lib/functions/freifunk-berlin-network.sh
@@ -1,5 +1,11 @@
 #!/bin/sh
 
+#shellcheck shell=dash
+
+# minor stuff. Not important in this place
+# shellcheck disable=SC2034
+
+# shellcheck source=/dev/null
 . /lib/functions/guard.sh
 
 create_ffuplink() {
@@ -29,8 +35,8 @@ generate_random_mac_hex() {
   # Create a static macaddr starting with "prefix" for ffuplink devices
   # See the website https://www.itwissen.info/MAC-Adresse-MAC-address.html
   for byte in 2 3 4 5 6; do
-    macaddr=$macaddr`dd if=/dev/urandom bs=1 count=1 2> /dev/null | hexdump -e '1/1 ":%02x"'`
+    macaddr=$macaddr$(dd if=/dev/urandom bs=1 count=1 2> /dev/null | hexdump -e '1/1 ":%02x"')
   done
 
-  echo $prefix$macaddr
+  echo "$prefix$macaddr"
 }
diff --git a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-correct-nsm2-txpower b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-correct-nsm2-txpower
index edd0c2b1..47989855 100755
--- a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-correct-nsm2-txpower
+++ b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-correct-nsm2-txpower
@@ -4,15 +4,19 @@
 # see https://github.com/freifunk-berlin/firmware/issues/381
 #
 
-[ ! $(command -v iwinfo) ] && exit 0
+# shellcheck shell=dash
+# shellcheck disable=SC2181
+
+[ ! "$(command -v iwinfo)" ] && exit 0
 iwinfo|grep -q 'NanoStation M2\|NanoStation Loco M2' || exit 0
 
+# shellcheck source=/dev/null
 . /lib/functions/guard.sh
 guard "NSm2_txpower"
 
 set_default_txpower() {
  echo "setting txpower value to $1 dBm"
- uci set wireless.radio0.txpower=$1
+ uci set wireless.radio0.txpower="$1"
  uci commit wireless
 }
 
@@ -20,13 +24,13 @@ MAX_TX_2G=20
 # get "TX offset" of 1st interface, if this is unknown set it to 0dB
 # then only return the numerical value
 ANT_GAIN=$(iwinfo |grep -m 1 "TX power offset:" |sed -e "s/unknown/0 dB/" |tr -dc '0-9')
-NEW_TX=$(echo $(($MAX_TX_2G - $ANT_GAIN)))
+NEW_TX=$((MAX_TX_2G - ANT_GAIN))
 
 CURR_TX=$(uci -q get wireless.radio0.txpower)
 # check if txpower is defined in config
 if [ $? -ne 0 ]; then
   echo -n "txpower not defined - "
   set_default_txpower $NEW_TX
-elif [ $CURR_TX -gt $NEW_TX ]; then
+elif [ "$CURR_TX" -gt $NEW_TX ]; then
   set_default_txpower $NEW_TX
 fi
diff --git a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-ffuplink-defaults b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-ffuplink-defaults
index b9c601ee..d2759422 100644
--- a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-ffuplink-defaults
+++ b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-ffuplink-defaults
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+# shellcheck source=/dev/null
 . /lib/functions/freifunk-berlin-network.sh
 . /lib/functions/guard.sh
 guard "ffberlin_uplink"
diff --git a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-network-defaults b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-network-defaults
index 1024e9c0..2372853a 100644
--- a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-network-defaults
+++ b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-network-defaults
@@ -1,5 +1,8 @@
 #!/bin/sh
 
+# shellcheck disable=SC2086
+
+# shellcheck source=/dev/null
 . /lib/functions/guard.sh
 guard "network"
 
@@ -7,7 +10,7 @@ guard "network"
 uci set network.lan.ipaddr=192.168.42.1
 
 WANDEV=$(uci -q get network.wan.device)
-echo ${WANDEV} | grep ^br- > /dev/null
+echo "${WANDEV}" | grep ^br- > /dev/null
 BRIDGECHECK=$?
 
 # setup wan as a bridge
@@ -39,13 +42,13 @@ else
   NEWDEV=$(uci add network device)
   uci set network.$NEWDEV.type="bridge"
   uci set network.$NEWDEV.name="br-wan"
-  uci add_list network.$NEWDEV.ports=${WANDEV}
+  uci add_list network.$NEWDEV.ports="${WANDEV}"
 
   uci set network.wan.device="br-wan"
   uci set network.wan6.device="br-wan"
 fi
 
-# do not use dns servers provided by dhcp - we maintain a static list of 
+# do not use dns servers provided by dhcp - we maintain a static list of
 # dns servers instead
 uci set network.wan.peerdns=0
 uci set network.wan6.peerdns=0
diff --git a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-network-ip-route b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-network-ip-route
index 681849df..35892c07 100644
--- a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-network-ip-route
+++ b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-network-ip-route
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+# shellcheck source=/dev/null
 . /lib/functions/guard.sh
 guard "iproute"
 
diff --git a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-pingcheck-defaults b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-pingcheck-defaults
index 0e762e20..007add7b 100644
--- a/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-pingcheck-defaults
+++ b/packages/falter-berlin-network-defaults/uci-defaults/freifunk-berlin-pingcheck-defaults
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+# shellcheck source=/dev/null
 . /lib/functions.sh
 
 # remove the sta interface, leaving only wan
diff --git a/packages/falter-berlin-tunnelmanager/Makefile b/packages/falter-berlin-tunnelmanager/Makefile
index 0a1fd9d5..7d9bc081 100644
--- a/packages/falter-berlin-tunnelmanager/Makefile
+++ b/packages/falter-berlin-tunnelmanager/Makefile
@@ -1,18 +1,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=falter-berlin-tunnelmanager
-PKG_VERSION:=0.3.1
+PKG_VERSION:=0.4
 
 include $(INCLUDE_DIR)/package.mk
 
-# todo: add dependency on jshn
-
 define Package/falter-berlin-tunnelmanager
   SECTION:=falter-berlin
   CATEGORY:=falter-berlin
   TITLE:=Freifunk Berlin tunnelmanager
   URL:=https://github.com/freifunk-berlin/falter-packages
-  EXTRA_DEPENDS:=coreutils-timeout, ip-full, kmod-macvlan, wg-installer-client
+  EXTRA_DEPENDS:=coreutils-timeout, ip-full, kmod-macvlan, wg-installer-client, jshn
   PKGARCH:=all
 endef
 
diff --git a/packages/falter-berlin-tunnelmanager/files/down.sh b/packages/falter-berlin-tunnelmanager/files/down.sh
index 284d5ca3..e3c121f5 100644
--- a/packages/falter-berlin-tunnelmanager/files/down.sh
+++ b/packages/falter-berlin-tunnelmanager/files/down.sh
@@ -3,7 +3,7 @@
 interface="$1"
 
 uci revert olsrd
-section="$(uci show olsrd | grep $interface | awk -F '.interface' '{print $1}')"
+section="$(uci show olsrd | grep "$interface" | awk -F '.interface' '{print $1}')"
 uci delete "$section"
 uci commit olsrd
 
@@ -11,8 +11,8 @@ uci commit olsrd
 ubus call olsrd del_interface '{"ifname":'\""$interface"\"'}'
 
 uci revert babeld
-section="$(uci show babeld | grep interface | grep $interface | awk -F '.ifname' '{print $1}')"
-filter="$(uci show babeld | grep filter | grep $interface | awk -F '.if' '{print $1}')"
+section="$(uci show babeld | grep interface | grep "$interface" | awk -F '.ifname' '{print $1}')"
+filter="$(uci show babeld | grep filter | grep "$interface" | awk -F '.if' '{print $1}')"
 uci delete "$section"
 uci delete "$filter"
 uci commit babeld
diff --git a/packages/falter-berlin-tunnelmanager/files/tunnelman.sh b/packages/falter-berlin-tunnelmanager/files/tunnelman.sh
index bdd5009f..b9827e22 100755
--- a/packages/falter-berlin-tunnelmanager/files/tunnelman.sh
+++ b/packages/falter-berlin-tunnelmanager/files/tunnelman.sh
@@ -1,5 +1,12 @@
 #! /bin/sh
 
+# shellcheck shell=dash
+
+# in most cases this directive alarms, we don't care for the return values, as we do other checks.
+# shellcheck disable=SC2155
+# in that case it doesn't work to do it another way. We need that value twice.
+# shellcheck disable=SC2181
+
 # except than noted, this script is not posix-compliant in one way: we use "local"
 # variables definition. As nearly all shells out there implement local, this should
 # work anyway. This is a little reminder to you, if you use some rare shell without
@@ -98,7 +105,7 @@ get_age() {
 
 teardown() {
     local interface="$1"
-    local endpoint="$(wg show $interface endpoints | awk -F '\t|:' '{print $2}')"
+    local endpoint="$(wg show "$interface" endpoints | awk -F '\t|:' '{print $2}')"
 
     sh "$OPT_DOWN_SCRIPT" "$interface"
     ip link delete "$interface"
@@ -110,17 +117,17 @@ teardown() {
 wg_get_usage() {
     local server="$1"
     # ToDo: PASSWORDS!!!!11!!111!!
-    clients=$(timeout 60 ip netns exec $OPT_NAMESPACE_NAME wg-client-installer get_usage --endpoint "$server" --user wginstaller --password wginstaller)
+    clients=$(timeout 60 ip netns exec "$OPT_NAMESPACE_NAME" wg-client-installer get_usage --endpoint "$server" --user wginstaller --password wginstaller)
     if [ $? -ne 0 ]; then
         return 1
     fi
-    echo "$(echo "$clients" | cut -d' ' -f2)"
+    echo "$clients" | cut -d' ' -f2
 }
 
 get_least_used_tunnelserver() {
     local tunnel_endpoints="$1"
 
-    # Dont check tunnelserver we already have a connection with
+    # Don't check tunnelserver we already have a connection with
     for i in $(wg show all endpoints | awk -F '\t|:' '{print $3}'); do
         # remove ip from connections:
         tunnel_endpoints=$(echo "$tunnel_endpoints" | sed "s/$i//")
@@ -135,7 +142,7 @@ get_least_used_tunnelserver() {
         if [ $? -ne 0 ]; then
             log "Error while querying tunnelserver $i for utilization"
 
-        elif [ $current -le $usercount ]; then
+        elif [ "$current" -le $usercount ]; then
             best=$i
             usercount=$current
         fi
@@ -161,7 +168,7 @@ new_tunnel() {
     local nsname="$2"
     local mtu="$3"
 
-    local interface="$(timeout 5 ip netns exec $OPT_NAMESPACE_NAME wg-client-installer register --lookup-default-namespace --endpoint "$ip" --user wginstaller --password wginstaller --wg-key-file $gw_pub --mtu $mtu)"
+    local interface="$(timeout 5 ip netns exec "$OPT_NAMESPACE_NAME" wg-client-installer register --lookup-default-namespace --endpoint "$ip" --user wginstaller --password wginstaller --wg-key-file $gw_pub --mtu "$mtu")"
 
     if [ -z "$interface" ]; then
         log "Failed to register a new tunnel."
@@ -192,7 +199,7 @@ manage() {
     # Check for stale tunnels and tear em down
     while true; do
         for interface in $interfaces; do
-            if [ $(get_age "$interface") -ge $OPT_TUNNEL_TIMEOUT ]; then
+            if [ "$(get_age "$interface")" -ge "$OPT_TUNNEL_TIMEOUT" ]; then
                 log "Tunnel to $interface timed out."
                 teardown "$interface"
             fi
@@ -200,9 +207,9 @@ manage() {
 
         tmp_tunnel_endpoints="$tunnel_endpoints"
 
-        while [ $(echo $connections | wc -w) -lt $connection_count ]; do
+        while [ "$(echo "$connections" | wc -w)" -lt "$connection_count" ]; do
             ep=$(get_least_used_tunnelserver "$tmp_tunnel_endpoints")
-            if [ ! -z "$ep" ]; then
+            if [ -n "$ep" ]; then
                 log "Server handling least clients is: $ep. Trying to create tunnel..."
                 if ! new_tunnel "$ep" "$nsname" "$mtu"; then
                     # remove ep from tunnel
@@ -276,9 +283,9 @@ log "starting tunnelmanager with
     Uplink-IP............: $OPT_UPLINK_IP
     Uplink-GW............: $OPT_UPLINK_GW
     MTU..................: $OPT_MTU
-    Namespace............: $OPT_NAMESPACE_NAME 
-    Tunnel-Endpoints.....: $OPT_TUNNEL_ENDPOINTS 
-    Tunnel-Count.........: $OPT_TUNNEL_COUNT 
+    Namespace............: $OPT_NAMESPACE_NAME
+    Tunnel-Endpoints.....: $OPT_TUNNEL_ENDPOINTS
+    Tunnel-Count.........: $OPT_TUNNEL_COUNT
     Tunnel-Timeout.......: $OPT_TUNNEL_TIMEOUT
     Work-Interval........: $OPT_INTERVAL
     Up_Script............: $OPT_UP_SCRIPT
diff --git a/packages/falter-berlin-tunnelmanager/files/up.sh b/packages/falter-berlin-tunnelmanager/files/up.sh
index 735f341c..a301424d 100644
--- a/packages/falter-berlin-tunnelmanager/files/up.sh
+++ b/packages/falter-berlin-tunnelmanager/files/up.sh
@@ -1,5 +1,12 @@
 #!/bin/sh
 
+# shellcheck shell=dash
+
+# in most cases this directive alarms, we don't care for the return values, as we do other checks.
+# shellcheck disable=SC2155
+# in that case it doesn't work to do it another way. We need that value twice.
+# shellcheck disable=SC2181
+
 interface="$1"
 
 # can be controlled using tunnelmanagers "-A" parameter
@@ -7,7 +14,7 @@ extra_args="$2"
 
 prefix=$(echo "$extra_args" | cut -d ' ' -f1)
 
-argc=$(echo $extra_args | wc -w)
+argc=$(echo "$extra_args" | wc -w)
 if [ "$argc" -gt "2" ]; then
     metric=$(echo "$extra_args" | cut -d ' ' -f2)
     lqm=$(echo "$extra_args" | cut -d ' ' -f3)
@@ -16,7 +23,7 @@ fi
 get_ips_from_prefix() {
     local prefix="$1"
     local amount="$(owipcalc "$prefix" howmany 32)"
-    local command="owipcalc "$prefix" network print"
+    local command="owipcalc $prefix network print"
     for i in $(seq 2 "$amount"); do
         command="$command next 32 print add 1"
     done
@@ -40,7 +47,7 @@ cleanup_olsr_wg_config() {
         fi
 
         # skip non wireguard interfaces
-        slicedint=$(echo $int_name | cut -c1-3)
+        slicedint=$(echo "$int_name" | cut -c1-3)
         if [ "${slicedint}" != "wg_" ]; then
             i=$((i + 1))
             continue
@@ -76,7 +83,7 @@ cleanup_babel_wg_config() {
         fi
 
         # skip non wireguard interfaces
-        slicedint=$(echo $int_name | cut -c1-3)
+        slicedint=$(echo "$int_name" | cut -c1-3)
         if [ "${slicedint}" != "wg_" ]; then
             i=$((i + 1))
             continue
@@ -104,10 +111,10 @@ get_ips_from_prefix "$prefix"
 # unconditionally wipe all configured ips from available ips.
 available_ips="$_ret_prefixes"
 for i in $(get_configured_ips); do
-    available_ips="$(echo $available_ips | sed "s/\b$i\b//")"
+    available_ips="$(echo "$available_ips" | sed "s/\b$i\b//")"
 done
 
-next_ip="$(echo $available_ips | awk '{print $1}')"
+next_ip="$(echo "$available_ips" | awk '{print $1}')"
 
 # Configure IPs
 ip address add "$next_ip/32" dev "$interface"
@@ -129,7 +136,7 @@ UCIREF="$(uci add olsrd Interface)"
 uci set "olsrd.$UCIREF.ignore=0"
 uci set "olsrd.$UCIREF.interface=$interface"
 uci set "olsrd.$UCIREF.Mode=ether"
-if [[ ! -z "$lqm" ]]; then
+if [ -n "$lqm" ]; then
     uci set "olsrd.$UCIREF.LinkQualityMult=default $lqm"
 fi
 uci commit olsrd
@@ -141,7 +148,7 @@ if [ $? -eq 1 ]; then
     /etc/init.d/olsrd start
 else
     # instead of reloading add interface via ipc to make it seamless
-    if [[ ! -z "$lqm" ]]; then
+    if [ -n "$lqm" ]; then
         ubus call olsrd add_interface '{"ifname":'\""$interface"\"',"lqm":'\""$lqm"\"'}'
     else
         ubus call olsrd add_interface '{"ifname":'\""$interface"\"'}'
@@ -155,7 +162,7 @@ uci set "babeld.$UCIREF.ifname=$interface"
 uci set "babeld.$UCIREF.split_horizon=true"
 uci commit babeld
 
-if [[ ! -z "$metric" ]]; then
+if [ -n "$metric" ]; then
     uci revert babeld
     UCIREF="$(uci add babeld filter)"
     uci set "babeld.$UCIREF.type=in"
@@ -173,7 +180,7 @@ if [ $? -eq 1 ]; then
 else
     # instead of reloading add interface via ipc to make it seamless
     ubus call babeld add_interface '{"ifname":'\""$interface"\"'}'
-    if [[ ! -z "$metric" ]]; then
-        ubus call babeld add_filter '{"ifname":'\""$interface"\"',"type":0,"metric":'$metric'}'
+    if [ -n "$metric" ]; then
+        ubus call babeld add_filter '{"ifname":'\""$interface"\"',"type":0,"metric":'"$metric"'}'
     fi
 fi
diff --git a/packages/falter-berlin-uplink-notunnel/Makefile b/packages/falter-berlin-uplink-notunnel/Makefile
index 63c1dc38..b6243881 100644
--- a/packages/falter-berlin-uplink-notunnel/Makefile
+++ b/packages/falter-berlin-uplink-notunnel/Makefile
@@ -2,7 +2,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=falter-berlin-uplink-notunnel
-PKG_VERSION:=2
+PKG_VERSION:=3
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/packages/falter-berlin-uplink-notunnel/files/etc/pingcheck/offline.d/60-freifunk-notunnel b/packages/falter-berlin-uplink-notunnel/files/etc/pingcheck/offline.d/60-freifunk-notunnel
index fa7fd796..c4831de3 100755
--- a/packages/falter-berlin-uplink-notunnel/files/etc/pingcheck/offline.d/60-freifunk-notunnel
+++ b/packages/falter-berlin-uplink-notunnel/files/etc/pingcheck/offline.d/60-freifunk-notunnel
@@ -1,5 +1,8 @@
 #!/bin/sh
 
+# shellcheck source=/dev/null
+# shellcheck disable=SC2154
+
 [ "$INTERFACE" = wan ] || exit
 
 . /lib/functions.sh
diff --git a/packages/falter-berlin-uplink-notunnel/files/etc/pingcheck/online.d/60-freifunk-notunnel b/packages/falter-berlin-uplink-notunnel/files/etc/pingcheck/online.d/60-freifunk-notunnel
index 9c1d1403..eaf710bf 100755
--- a/packages/falter-berlin-uplink-notunnel/files/etc/pingcheck/online.d/60-freifunk-notunnel
+++ b/packages/falter-berlin-uplink-notunnel/files/etc/pingcheck/online.d/60-freifunk-notunnel
@@ -1,5 +1,8 @@
 #!/bin/sh
 
+# shellcheck disable=SC2154
+# shellcheck source=/dev/null
+
 [ "$INTERFACE" = wan ] || exit
 
 . /lib/functions.sh
@@ -12,9 +15,9 @@ config_get ffuplink preset current
 # Make sure ffuplink is not already up
 . /usr/share/libubox/jshn.sh
 json_load "$(ubus call network.interface.ffuplink status)"
-json_select $1
+json_select "$1"
 json_get_vars up
-[ "$up" == "0" ] || exit
+[ "$up" = "0" ] || exit
 
 # Internet connectivity via WAN is up, start the ffuplink interface
 # In the case where ffuplink is set disabled '1', then ifup dies quietly
diff --git a/packages/falter-berlin-uplink-notunnel/uci-defaults/freifunk-berlin-z95_notunnel b/packages/falter-berlin-uplink-notunnel/uci-defaults/freifunk-berlin-z95_notunnel
index c8864163..b4ec0709 100644
--- a/packages/falter-berlin-uplink-notunnel/uci-defaults/freifunk-berlin-z95_notunnel
+++ b/packages/falter-berlin-uplink-notunnel/uci-defaults/freifunk-berlin-z95_notunnel
@@ -1,8 +1,16 @@
 #!/bin/sh
 
+# shellcheck shell=dash
+
+# shellcheck source=/dev/null
+
+# shellcheck disable=SC2034
+# shellcheck disable=SC2155
+# shellcheck disable=SC2140
+
 THIS_UPLINKNAME="notunnel"
 
-. /lib/functions/freifunk-berlin-network.sh 
+. /lib/functions/freifunk-berlin-network.sh
 . /lib/functions/guard.sh
 . /lib/functions.sh
 
@@ -11,11 +19,11 @@ uci set firewall.zone_ffuplink.masq=1
 uci commit firewall
 
 current_preset=$(uci get ffberlin-uplink.preset.current)
-if [ ${current_preset} != ${THIS_UPLINKNAME} ]; then
+if [ "${current_preset}" != ${THIS_UPLINKNAME} ]; then
   # do not track preset when it was 'undefined', aka never configured
-  if [ ${current_preset} != "undefined" ]; then
+  if [ "${current_preset}" != "undefined" ]; then
     logger -t "ffuplink" "uplink-preset has been changed."
-    uci set ffberlin-uplink.preset.previous=${current_preset}
+    uci set ffberlin-uplink.preset.previous="${current_preset}"
     create_ffuplink
   fi
   uci set ffberlin-uplink.preset.current=${THIS_UPLINKNAME}
@@ -24,7 +32,7 @@ fi
 uci set ffberlin-uplink.uplink.auth=none
 
 # disable tunneldigger for ffuplink, if tunneldigger was the previous setup
-if [ ${current_preset} == "tunnelberlin_tunneldigger" ]; then
+if [ "${current_preset}" = "tunnelberlin_tunneldigger" ]; then
   uci set tunneldigger.ffuplink.enabled=0
   uci commit tunneldigger
 fi
@@ -32,7 +40,7 @@ fi
 macaddr=$(uci -q get ffberlin-uplink.uplink.macaddr)
 if [ -z "$macaddr" ]; then
   macaddr=$(generate_random_mac_hex "fe")
-  uci set ffberlin-uplink.uplink.macaddr=$macaddr
+  uci set ffberlin-uplink.uplink.macaddr="$macaddr"
 fi
 
 uci commit ffberlin-uplink
@@ -44,25 +52,25 @@ uci set network.ffuplink_dev=device
 uci set network.ffuplink_dev.type=veth
 uci set network.ffuplink_dev.name=ffuplink
 uci set network.ffuplink_dev.peer_name=ffuplink_wan
-uci set network.ffuplink_dev.macaddr=$macaddr
+uci set network.ffuplink_dev.macaddr="$macaddr"
 uci commit network.ffuplink_dev
 
 # add ffuplink_dev to the br-wan bridge if not there
 devname=$(uci get network.wan.device)
 handle_wan_device() {
-  local config=$1
+  local config="$1"
   local name=""
   local ports=""
-  local wandev=$(uci -q get network.wan.device)
-  if [ -z $wandev ]; then
+  local wandev="$(uci -q get network.wan.device)"
+  if [ -z "$wandev" ]; then
     return
   fi
 
-  config_get name $config name
-  if [ "X${name}X" == "Xbr-wanX" ]; then
-    config_get ports $config ports
-    list_contains ports ffuplink_wan || uci add_list network.${config}.ports="ffuplink_wan"
-    uci commit network.${config}
+  config_get name "$config" name
+  if [ "X${name}X" = "Xbr-wanX" ]; then
+    config_get ports "$config" ports
+    list_contains ports ffuplink_wan || uci add_list network."${config}".ports="ffuplink_wan"
+    uci commit network."${config}"
   fi
 }
 
@@ -71,6 +79,6 @@ config_load network
 config_foreach handle_wan_device device
 
 uci set network.ffuplink.proto=dhcp
-uci set network.ffuplink.hostname=freifunk-$(echo $macaddr|tr -d :)-uplink
+uci set network.ffuplink.hostname=freifunk-"$(echo "$macaddr"|tr -d :)"-uplink
 uci commit network.ffuplink
 
diff --git a/packages/falter-berlin-uplink-tunnelberlin/Makefile b/packages/falter-berlin-uplink-tunnelberlin/Makefile
index e111972b..0a5e8aa5 100644
--- a/packages/falter-berlin-uplink-tunnelberlin/Makefile
+++ b/packages/falter-berlin-uplink-tunnelberlin/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=falter-berlin-uplink-tunnelberlin
-PKG_VERSION:=2
+PKG_VERSION:=3
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/packages/falter-berlin-uplink-tunnelberlin/uci-defaults/freifunk-berlin-z95_tunnelberlin-tunneldigger b/packages/falter-berlin-uplink-tunnelberlin/uci-defaults/freifunk-berlin-z95_tunnelberlin-tunneldigger
index 8959654e..b6e4ec00 100644
--- a/packages/falter-berlin-uplink-tunnelberlin/uci-defaults/freifunk-berlin-z95_tunnelberlin-tunneldigger
+++ b/packages/falter-berlin-uplink-tunnelberlin/uci-defaults/freifunk-berlin-z95_tunnelberlin-tunneldigger
@@ -1,8 +1,12 @@
 #!/bin/sh
 
+# shellcheck source=/dev/null
+# shellcheck disable=SC2034
+
+
 THIS_UPLINKNAME="tunnelberlin_tunneldigger"
 
-. /lib/functions/freifunk-berlin-network.sh 
+. /lib/functions/freifunk-berlin-network.sh
 . /lib/functions/guard.sh
 . /lib/functions/system.sh
 
@@ -11,13 +15,13 @@ uci set firewall.zone_ffuplink.masq=1
 uci commit firewall
 
 current_preset=$(uci get ffberlin-uplink.preset.current)
-if [ ${current_preset} != ${THIS_UPLINKNAME} ]; then
-  if [ ${current_preset} != "undefined" ]; then
+if [ "${current_preset}" != ${THIS_UPLINKNAME} ]; then
+  if [ "${current_preset}" != "undefined" ]; then
       # when the uplink-preset has changed, recreate remember the preset we are coming from
       # and prepare for reinit of the relevant settings via freifunk-berlin-ffuplink-defaults
       # uci-defaults
       logger -t "ffuplink" "uplink-preset has been changed."
-      uci set ffberlin-uplink.preset.previous=${current_preset}
+      uci set ffberlin-uplink.preset.previous="${current_preset}"
       create_ffuplink
   fi
   uci set ffberlin-uplink.preset.current=${THIS_UPLINKNAME}
@@ -28,7 +32,7 @@ uci set ffberlin-uplink.uplink.auth=none
 macaddr=$(uci -q get ffberlin-uplink.uplink.macaddr)
 if [ -z "$macaddr" ]; then
   macaddr=$(generate_random_mac_hex "fe")
-  uci set ffberlin-uplink.uplink.macaddr=$macaddr
+  uci set ffberlin-uplink.uplink.macaddr="$macaddr"
 fi
 
 uci commit ffberlin-uplink
@@ -38,7 +42,7 @@ guard "tunnelberlin_tunneldigger"
 uci delete network.ffuplink_dev
 uci set network.ffuplink_dev=device
 uci set network.ffuplink_dev.name=ffuplink
-uci set network.ffuplink_dev.macaddr=$macaddr
+uci set network.ffuplink_dev.macaddr="$macaddr"
 uci commit network.ffuplink_dev
 
 uci set network.ffuplink.proto=dhcp
@@ -49,7 +53,7 @@ UUID=$(uci -q get tunneldigger.ffuplink.uuid)
 if [ $? -eq 1 ]; then
   UUID=$macaddr
   for byte in 7 8 9 10; do
-    UUID=$UUID`dd if=/dev/urandom bs=1 count=1 2> /dev/null | hexdump -e '1/1 ":%02x"'`
+    UUID=$UUID$(dd if=/dev/urandom bs=1 count=1 2> /dev/null | hexdump -e '1/1 ":%02x"')
   done
 fi
 
@@ -58,7 +62,7 @@ uci set tunneldigger.ffuplink=broker
 # Remove old address list in excahange with srv
 uci -q delete tunneldigger.ffuplink.address
 uci set tunneldigger.ffuplink.srv='_tunnel._udp.berlin.freifunk.net'
-uci set tunneldigger.ffuplink.uuid=$UUID
+uci set tunneldigger.ffuplink.uuid="$UUID"
 uci set tunneldigger.ffuplink.interface=ffuplink
 uci set tunneldigger.ffuplink.broker_selection=usage
 uci set tunneldigger.ffuplink.bind_interface=wan
diff --git a/packages/falter-policyrouting/Makefile b/packages/falter-policyrouting/Makefile
index a96c3350..47cc3e46 100644
--- a/packages/falter-policyrouting/Makefile
+++ b/packages/falter-policyrouting/Makefile
@@ -4,7 +4,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=falter-policyrouting
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 
diff --git a/packages/falter-policyrouting/files/etc/hotplug.d/iface/30-policyrouting b/packages/falter-policyrouting/files/etc/hotplug.d/iface/30-policyrouting
index 34ab9eb7..5ecbcd91 100644
--- a/packages/falter-policyrouting/files/etc/hotplug.d/iface/30-policyrouting
+++ b/packages/falter-policyrouting/files/etc/hotplug.d/iface/30-policyrouting
@@ -1,9 +1,17 @@
 #!/bin/sh
 
+# shellcheck disable=SC2154
+# shellcheck disable=SC2181
+# ToDo: fix that two later. Not sure, if the suggested solution has negative impact on the execution
+# shellcheck disable=SC2143
+# shellcheck disable=SC2069
+
 [ "$INTERFACE" = wan ] && exit
 [ "$INTERFACE" = ffuplink ] && exit
 
+# shellcheck source=/dev/null
 . /lib/functions.sh
+# shellcheck source=/dev/null
 . /lib/functions/network.sh
 
 proto="4"
@@ -16,18 +24,18 @@ config_get strict pr strict
 config_get zones pr zones
 
 if [ "$ACTION" = "ifup" ] && [ "$enable" = "1" ]; then
-	case $(uci get network.${INTERFACE}.proto) in none)
+	case $(uci get network."${INTERFACE}".proto) in none)
 		# ubus status/netifd does not output ip4addr if proto=none
-		net=$(ip -4 addr show dev ${DEVICE} scope global|sed -n '2s,^[[:space:]]\+inet \([^[:space:]]\+\).*,\1,p')
+		net=$(ip -4 addr show dev "${DEVICE}" scope global|sed -n '2s,^[[:space:]]\+inet \([^[:space:]]\+\).*,\1,p')
 		#net6=$(ip -6 addr show dev ${DEVICE} scope global|sed -n '2s,^[[:space:]]\+inet6 \([^[:space:]]\+\).*,\1,p')
 	;;*)
-		network_get_subnet net $INTERFACE
+		network_get_subnet net "$INTERFACE"
 		#network_get_subnet6 net6 $INTERFACE
 	;;esac
 
-	if [ "$net" != "" -a -n "${DEVICE}" ]; then
-		eval $(/bin/ipcalc.sh $net)
-		if [ "$PREFIX" != "0" -a "$NETWORK" != "127.0.0.0" ]; then
+	if [ "$net" != "" ] && [ -n "${DEVICE}" ]; then
+		eval "$(/bin/ipcalc.sh "$net")"
+		if [ "$PREFIX" != "0" ] && [ "$NETWORK" != "127.0.0.0" ]; then
 			if [ ! "$(ip route show table localnets |grep "$NETWORK/$PREFIX dev")" ]; then
 				cmd="ip route add $NETWORK/$PREFIX dev ${DEVICE} table localnets"
 				$cmd
@@ -60,7 +68,7 @@ if [ "$ACTION" = "ifup" ] && [ "$enable" = "1" ]; then
 
 		networks=""
 		for z in $zones; do
-			network_zone="$(uci -q get firewall.zone_${z}.network)"
+			network_zone="$(uci -q get firewall.zone_"${z}".network)"
 			if [ -z "$network_zone" ]; then
 				network_zone="$z"
 			fi
@@ -72,25 +80,25 @@ if [ "$ACTION" = "ifup" ] && [ "$enable" = "1" ]; then
 					logger -s -t policyrouting "Use mesh gateway for interface ${DEVICE} (IPv$p)"
 
 					# add olsr-tunnel rule (SmartGateway tunnel) if not present
-					if [ ! "$(ip -$p rule show | egrep "from all iif ${DEVICE} (\[detached\] )?lookup olsr-tunnel")" ]; then
+					if [ ! "$(ip -$p rule show | grep -E "from all iif ${DEVICE} (\[detached\] )?lookup olsr-tunnel")" ]; then
 						ip -$p rule add dev "${DEVICE}" lookup olsr-tunnel prio 19999
 					fi
 
 					# add olsr-default rule (Default route from mesh) if not present
-					if [ ! "$(ip -$p rule show | egrep "from all iif ${DEVICE} (\[detached\] )?lookup olsr-default")" ]; then
+					if [ ! "$(ip -$p rule show | grep -E "from all iif ${DEVICE} (\[detached\] )?lookup olsr-default")" ]; then
 						ip -$p rule add dev "${DEVICE}" lookup olsr-default prio 20000
 					fi
 
 					# add unreachable rules (prevents using router's default route (without VPN))
-					if [ "$strict" != 0 ] && [ ! "$(ip -$p rule show | egrep "from all iif ${DEVICE} (\[detached\] )?unreachable")" ]; then
+					if [ "$strict" != 0 ] && [ ! "$(ip -$p rule show | grep -E "from all iif ${DEVICE} (\[detached\] )?unreachable")" ]; then
 						ip -$p rule add dev "${DEVICE}" unreachable prio 20001
 					fi
 
 					# uci stuff
-					if [ -z "$(uci -P /var/state get freifunk-policyrouting.${INTERFACE})" ]; then
-						uci -P /var/state set freifunk-policyrouting.${INTERFACE}="state"
+					if [ -z "$(uci -P /var/state get freifunk-policyrouting."${INTERFACE}")" ]; then
+						uci -P /var/state set freifunk-policyrouting."${INTERFACE}"="state"
 					fi
-					uci -P /var/state set freifunk-policyrouting.${INTERFACE}.device="${DEVICE}"
+					uci -P /var/state set freifunk-policyrouting."${INTERFACE}".device="${DEVICE}"
 
 				done
 			fi
diff --git a/packages/falter-policyrouting/files/etc/init.d/freifunk-policyrouting b/packages/falter-policyrouting/files/etc/init.d/freifunk-policyrouting
index 1f105e3f..fd97b35d 100755
--- a/packages/falter-policyrouting/files/etc/init.d/freifunk-policyrouting
+++ b/packages/falter-policyrouting/files/etc/init.d/freifunk-policyrouting
@@ -1,8 +1,25 @@
 #!/bin/sh /etc/rc.common
 
-START=15
-. $IPKG_INSTROOT/lib/functions/network.sh
-. $IPKG_INSTROOT/lib/functions.sh
+# shellcheck shell=dash
+
+# START var belongs to openwrt initscripts and get read by initd
+# shellcheck disable=SC2034
+# vars get assigned by config_get function...
+# shellcheck disable=SC2154
+# that one is intended exactly the way it is.
+# shellcheck disable=SC2140
+# seems to work in ash, but it only replaces the first '-' with one '_'. Other occurences remain...
+# shellcheck disable=SC3060
+# Not sure how to transform the following expressions
+# shellcheck disable=SC2143
+# shellcheck disable=SC2027
+
+START=
+
+# shellcheck source=/dev/null
+. "$IPKG_INSTROOT/lib/functions/network.sh"
+# shellcheck source=/dev/null
+. "$IPKG_INSTROOT/lib/functions.sh"
 
 proto="4"
 #[ -f /proc/net/ipv6_route ] && proto="4 6"
@@ -17,10 +34,10 @@ config_get zones pr zones
 
 olsrd_rmtables() {
 	for cfg in $cfgs; do
-		# Remove custom routing tables from olsrd 
-		if [ "`uci -q get $cfg.@olsrd[0].RtTable`" == "111" ] || [ "`uci -q get $cfg.@olsrd[0].RtTableDefault`" == "112" ]; then
-			uci delete $cfg.@olsrd[0].RtTable
-			uci delete $cfg.@olsrd[0].RtTableDefault
+		# Remove custom routing tables from olsrd
+		if [ "$(uci -q get "$cfg".@olsrd[0].RtTable)" = "111" ] || [ "$(uci -q get "$cfg".@olsrd[0].RtTableDefault)" = "112" ]; then
+			uci delete "$cfg".@olsrd[0].RtTable
+			uci delete "$cfg".@olsrd[0].RtTableDefault
 			uci commit
 		fi
 	done
@@ -28,24 +45,24 @@ olsrd_rmtables() {
 
 olsrd_intalltables() {
 	for cfg in $cfgs; do
-		if [ ! "`uci -q get $cfg.@olsrd[0].RtTable`" == "111" ] || [ ! "`uci -q get $cfg.@olsrd[0].RtTableDefault`" == "112" ]; then
-			uci set $cfg.@olsrd[0].RtTable='111'
-			uci set $cfg.@olsrd[0].RtTableDefault='112'
-			uci commit $cfg
-			/etc/init.d/$cfg restart 2&> /dev/null
+		if [ ! "$(uci -q get "$cfg".@olsrd[0].RtTable)" = "111" ] || [ ! "$(uci -q get "$cfg".@olsrd[0].RtTableDefault)" = "112" ]; then
+			uci set "$cfg".@olsrd[0].RtTable='111'
+			uci set "$cfg".@olsrd[0].RtTableDefault='112'
+			uci commit "$cfg"
+			/etc/init.d/"$cfg" restart > /dev/null 2>&1
 		fi
 	done
 }
 
 rt_tables() {
 	tables="/etc/iproute2/rt_tables"
-	if [ -z "`grep "110" $tables`" ]; then
+	if [ -z "$(grep "110" $tables)" ]; then
 		echo "110 localnets" >> $tables
 	fi
-	if [ -z "`grep "111" $tables`" ]; then
+	if [ -z "$(grep "111" $tables)" ]; then
 		echo "111 olsr" >> $tables
 	fi
-	if [ -z "`grep "112" $tables`" ]; then
+	if [ -z "$(grep "112" $tables)" ]; then
 		echo "112 olsr-default" >> $tables
 	fi
 
@@ -60,15 +77,15 @@ handle_disable_dyngw() {
 			config_get RtTable "$cfg" RtTable
 			if [ -z "$RtTable" ] || [ "$RtTable" = "254" ]; then
 				config_set "$cfg" ignore '1'
-				uci set $olsrd_cfg.$cfg.ignore="1"
-				uci commit $olsrd_cfg
+				uci set "$olsrd_cfg"."$cfg".ignore="1"
+				uci commit "$olsrd_cfg"
 				logger -s -t policyrouting -p info "dyngw_plain plugin disabled."
 			fi
 		;;
 		olsrd_dyn_gw.so*)
 			logger -s -t policyrouting -p info "$cfg"
-			uci set $olsrd_cfg.$cfg.ignore="1"
-				uci commit $olsrd_cfg
+			uci set "$olsrd_cfg"."$cfg".ignore="1"
+				uci commit "$olsrd_cfg"
 			logger -s -t policyrouting -p info "dyngw plugin disabled."
 		;;
 	esac
@@ -76,16 +93,16 @@ handle_disable_dyngw() {
 
 disable_dyngw() {
 	for olsrd_cfg in $cfgs; do
-		config_load $olsrd_cfg
-		config_foreach handle_disable_dyngw LoadPlugin $olsrd_cfg
+		config_load "$olsrd_cfg"
+		config_foreach handle_disable_dyngw LoadPlugin "$olsrd_cfg"
 	done
 }
 
 restart_services() {
 	logger -s -t policyrouting -p info "Restarting services"
-	/etc/init.d/network restart 2&> /dev/null
+	/etc/init.d/network restart > /dev/null 2>&1
 	for cfg in $cfgs; do
-		/etc/init.d/$cfg restart 2&> /dev/null
+		/etc/init.d/"$cfg" restart > /dev/null 2>&1
 	done
 }
 
@@ -100,13 +117,14 @@ boot() {
 }
 
 add_lookup_rule() {
+	# seems to work in ash, but it only replaces the first '-' with one '_'. Other occurences remain...
 	name=${1/-/_}
 	lookup=$2
 	prio=$3
 	in=$4
 	name=$name"_"${in:-allif}"_"
 
-	if [ -z "$name" -o -z "$lookup" -o -z "$prio" ]; then
+	if [ -z "$name" ] || [ -z "$lookup" ] || [ -z "$prio" ]; then
 		logger -s -t policyrouting "Missing parameters for add_rule!"
 	else
 		for p in $proto; do
@@ -115,7 +133,7 @@ add_lookup_rule() {
 			else
 				rule="rule"
 			fi
-			if [ "$(uci -q get network.${name}ipv${p})" != "$rule" ] ; then
+			if [ "$(uci -q get network."${name}"ipv${p})" != "$rule" ] ; then
 				uci batch <<- EOF
 					set network.${name}ipv${p}="$rule"
 					set network.${name}ipv${p}.lookup="$lookup"
@@ -129,13 +147,14 @@ add_lookup_rule() {
 }
 
 add_action_rule() {
+	# seems to work in ash, but it only replaces the first '-' with one '_'. Other occurences remain...
 	name=${1/-/_}
 	action=$2
 	prio=$3
 	in=$4
 	name=$name"_"${in:-allif}"_"
 
-	if [ -z "$name" -o -z "$action" -o -z "$prio" ]; then
+	if [ -z "$name" ] || [ -z "$action" ] || [ -z "$prio" ]; then
 		logger -s -t policyrouting "Missing parameters for add_action!"
 	else
 		for p in $proto; do
@@ -144,7 +163,7 @@ add_action_rule() {
 			else
 				rule="rule"
 			fi
-			if [ "$(uci -q get network.${name}ipv${p})" != "$rule" ] ; then
+			if [ "$(uci -q get network."${name}"ipv${p})" != "$rule" ] ; then
 				uci batch <<- EOF
 					set network.${name}ipv${p}="$rule"
 					set network.${name}ipv${p}.action="$action"
@@ -159,17 +178,18 @@ add_action_rule() {
 
 
 del_rule() {
+	# seems to work in ash, but it only replaces the first '-' with one '_'. Other occurences remain...
 	name=${1/-/_}
 	in=$2
 	name=$name"_"${in:-allif}"_"
 	for p in $proto; do
-		uci -q delete network.${name}ipv${p}
+		uci -q delete network."${name}"ipv${p}
 	done
 	uci commit network
 }
 
 start() {
-	if [ $enable = "1" ]; then
+	if [ "$enable" = "1" ]; then
 		logger -s -t policyrouting "Starting policy routing."
 		rt_tables
 		olsrd_intalltables
@@ -183,7 +203,7 @@ start() {
 		fi
 		networks=""
 		for z in $zones; do
-			network_zone="$(uci -q get firewall.zone_${z}.network)"
+			network_zone="$(uci -q get firewall.zone_"${z}".network)"
 			if [ -z "$network_zone" ]; then
 				network_zone="$z"
 			fi
@@ -194,11 +214,11 @@ start() {
 		for n in $networks; do
 			# only add route for tunnel if smart gateway is enabled
 			if [ "$sgw" = "yes" ]; then
-				add_lookup_rule olsr-tunnel olsr-tunnel 19999 $n
+				add_lookup_rule olsr-tunnel olsr-tunnel 19999 "$n"
 			fi
-			add_lookup_rule olsr-default olsr-default 20000 $n
+			add_lookup_rule olsr-default olsr-default 20000 "$n"
 			if [ "$strict" != 0 ]; then
-				add_action_rule olsr-default_unreachable unreachable 20001 $n
+				add_action_rule olsr-default_unreachable unreachable 20001 "$n"
 			fi
 		done
 	fi
@@ -216,7 +236,7 @@ stop() {
 	del_rule localnets
 	networks=""
 	for z in $zones; do
-		network_zone="$(uci -q get firewall.zone_${z}.network)"
+		network_zone="$(uci -q get firewall.zone_"${z}".network)"
 		if [ -z "$network_zone" ]; then
 			network_zone="$z"
 		fi
@@ -226,11 +246,11 @@ stop() {
 	sgw=$(uci -q get olsrd.@olsrd[0].SmartGateway)
 	for n in $networks; do
 		if [ "$sgw" = "yes" ]; then
-			del_rule olsr-tunnel $n
+			del_rule olsr-tunnel "$n"
 		fi
-		del_rule olsr-default $n
+		del_rule olsr-default "$n"
 		if [ "$strict" != 0 ]; then
-			del_rule olsr-default_unreachable $n
+			del_rule olsr-default_unreachable "$n"
 		fi
 	done
 	restart_services
diff --git a/packages/falter-policyrouting/files/etc/uci-defaults/freifunk-policyrouting b/packages/falter-policyrouting/files/etc/uci-defaults/freifunk-policyrouting
index 8bbc6a60..3731aee1 100644
--- a/packages/falter-policyrouting/files/etc/uci-defaults/freifunk-policyrouting
+++ b/packages/falter-policyrouting/files/etc/uci-defaults/freifunk-policyrouting
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+# shellcheck source=/dev/null
 . /lib/functions/guard.sh
 
 # guard will stop the script, if option was set already and will set it otherwise