diff --git a/build/build.sh b/build/build.sh
index 0112739..aebf070 100755
--- a/build/build.sh
+++ b/build/build.sh
@@ -118,6 +118,7 @@ packageset="$(cat "packageset/$(echo "$fversion" | cut -d'-' -f1)/$variant.txt"
     # let's get to work
     cd "$ibdir"
     mkdir -p "bin/targets/$target/faillogs"
+    mkdir -p embedded-files/etc
 
     # device profile help text, late because we need the extracted imagebuilder for that
     [ -n "$3" ] && profile="$3" || (
@@ -127,25 +128,38 @@ packageset="$(cat "packageset/$(echo "$fversion" | cut -d'-' -f1)/$variant.txt"
 
     # falter feed for imagebuilder
     arch="$(grep CONFIG_TARGET_ARCH_PACKAGES .config | cut -d'=' -f 2 | tr -d '"')"
-    if [ -n "$feed" ]; then
-        echo "src/gz falter $feed" >>repositories.conf
-        sed -i 's/option check_signature//g' repositories.conf
+    if [ "x$orelease" = "xsnapshot" ] ; then
+        # TODO falter feed available within the running image
+        # TODO disable signature check for custom feed url
+        adburl="$fmirror/feed/$frelease/packages/$arch/falter/packages.adb"
+        echo "$adburl" >> repositories
+        cat <<EOF1 > keys/falter.snapshot.pem
+-----BEGIN PUBLIC KEY-----
+MFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEE1NSmLpdMjXJpDQki9ziqW3Ve0aIX99t
+uAc1Yn5TexwhBhHsGxUxICHS63pDXYj9xg1AZHlvbEnFrBNrsdjJQQ==
+-----END PUBLIC KEY-----
+EOF1
     else
-        feedurl="$fmirror/feed/$frelease/packages/$arch/falter"
-        echo "src/gz falter $feedurl" >>repositories.conf
-        {
-            echo "untrusted comment: Falter OPKG Key 2024"
-            echo "$fkey"
-        } >"keys/$fkeyfp"
-    fi
+        if [ -n "$feed" ]; then
+            echo "src/gz falter $feed" >>repositories.conf
+            sed -i 's/option check_signature//g' repositories.conf
+        else
+            feedurl="$fmirror/feed/$frelease/packages/$arch/falter"
+            echo "src/gz falter $feedurl" >>repositories.conf
+            {
+                echo "untrusted comment: Falter OPKG Key 2024"
+                echo "$fkey"
+            } >"keys/$fkeyfp"
+        fi
 
-    # falter feed for the running image
-    mkdir -p embedded-files/etc/opkg/keys
-    if [ -n "$feed" ]; then
-        echo "src/gz falter $feed" >>embedded-files/etc/opkg/customfeeds.conf
-    else
-        echo "src/gz falter $feedurl" >>embedded-files/etc/opkg/customfeeds.conf
-        cp "keys/$fkeyfp" embedded-files/etc/opkg/keys
+        # falter feed for the running image
+        mkdir -p embedded-files/etc/opkg/keys
+        if [ -n "$feed" ]; then
+            echo "src/gz falter $feed" >>embedded-files/etc/opkg/customfeeds.conf
+        else
+            echo "src/gz falter $feedurl" >>embedded-files/etc/opkg/customfeeds.conf
+            cp "keys/$fkeyfp" embedded-files/etc/opkg/keys
+        fi
     fi
 
     # /etc/freifunk_release
@@ -200,7 +214,7 @@ EOF
     cp "$rootdir/store/favicon.png" "$d/"
 
     # go over all devices and build them
-    profilelist=$(make info | sed -n 's/\(^[a-zA-Z0-9_-]*\)\:$/\1/p')
+    profilelist=$(make info | sed -n 's/\(^[a-zA-Z0-9_-]*\)\:$/\1/p' | grep -v Default)
     echo -n "building profiles:"
     echo "$profilelist" | xargs echo -n "  "
     echo
diff --git a/packageset/1.4.0/backbone.txt b/packageset/1.2.4/notunnel.txt
similarity index 58%
rename from packageset/1.4.0/backbone.txt
rename to packageset/1.2.4/notunnel.txt
index 9179e00..9b27579 100644
--- a/packageset/1.4.0/backbone.txt
+++ b/packageset/1.2.4/notunnel.txt
@@ -3,7 +3,9 @@
 
 # Defaults
 falter-berlin-dhcp-defaults
+falter-berlin-firewall-defaults
 falter-berlin-freifunk-defaults
+falter-berlin-migration
 falter-berlin-network-defaults
 falter-berlin-olsrd-defaults
 falter-berlin-statistics-defaults
@@ -11,33 +13,39 @@ falter-berlin-system-defaults
 falter-berlin-uhttpd-defaults
 
 # Common
-#dnsmasq is already provided via dnsmasq-full
--dnsmasq
-
-# falter Common
-falter-common
-falter-common-olsr
-falter-berlin-tunneldigger
-
-# Utils
-tcpdump-mini
 mtr
 ip
 iperf3
 tmux
 vnstat
 ethtool
+#dnsmasq is already provided via dnsmasq-full
+-dnsmasq
+qos-scripts
+firewall
 iwinfo
 libiwinfo-lua
+tcpdump-mini
+
+# falter Common
+falter-common
+falter-common-olsr
+falter-policyrouting
+falter-profiles
+# allow upgrade from one type to another
+falter-berlin-tunneldigger
+falter-berlin-ssid-changer
 
 # GUI-basics
 uhttpd
 uhttpd-mod-ubus
 luci
 luci-ssl
+luci-app-ffwizard-falter
 luci-mod-falter
 luci-app-olsr
 luci-app-opkg
+luci-app-firewall
 luci-app-olsr-services
 luci-app-falter-owm
 luci-app-falter-owm-ant
@@ -48,27 +56,54 @@ luci-theme-bootstrap
 
 # GUI translation stuff
 luci-i18n-base-de
+luci-i18n-base-en
+luci-i18n-firewall-de
+luci-i18n-firewall-en
 luci-i18n-olsr-de
+luci-i18n-olsr-en
 luci-i18n-opkg-de
+luci-i18n-opkg-en
 luci-i18n-statistics-de
+luci-i18n-statistics-en
 luci-i18n-falter-de
+luci-i18n-falter-en
+luci-i18n-ffwizard-falter-de
+luci-i18n-ffwizard-falter-en
+luci-i18n-falter-policyrouting-de
+luci-i18n-falter-policyrouting-en
+
+# autoupdate
+falter-berlin-autoupdate
+falter-berlin-autoupdate-keys
+luci-app-falter-autoupdate
+luci-i18n-falter-autoupdate-de
+
+# service registrar
+falter-berlin-service-registrar
+luci-app-falter-service-registrar
+luci-i18n-falter-service-registrar-de
 
 # OLSR
 olsrd
+olsrd-utils
 olsrd-mod-arprefresh
 olsrd-mod-dyn-gw
 olsrd-mod-jsoninfo
 olsrd-mod-txtinfo
 olsrd-mod-nameservice
-olsrd-mod-watchdog
 kmod-ipip
 
+# Uplink
+falter-berlin-uplink-notunnel
+
 # Statistics
 luci-app-statistics
 collectd
+collectd-mod-cpu
 collectd-mod-dhcpleases
 collectd-mod-interface
 collectd-mod-iwinfo
+collectd-mod-load
 collectd-mod-network
 collectd-mod-olsrd
 collectd-mod-rrdtool
diff --git a/packageset/1.3.0/backbone.txt b/packageset/1.2.4/tunneldigger.txt
similarity index 71%
rename from packageset/1.3.0/backbone.txt
rename to packageset/1.2.4/tunneldigger.txt
index cc79f7b..c9e9866 100644
--- a/packageset/1.3.0/backbone.txt
+++ b/packageset/1.2.4/tunneldigger.txt
@@ -1,9 +1,11 @@
--wpad-mini
+#-wpad-mini
 #wpad
 
 # Defaults
 falter-berlin-dhcp-defaults
+falter-berlin-firewall-defaults
 falter-berlin-freifunk-defaults
+falter-berlin-migration
 falter-berlin-network-defaults
 falter-berlin-olsrd-defaults
 falter-berlin-statistics-defaults
@@ -11,33 +13,37 @@ falter-berlin-system-defaults
 falter-berlin-uhttpd-defaults
 
 # Common
-#dnsmasq is already provided via dnsmasq-full
--dnsmasq
-
-# falter Common
-falter-common
-falter-common-olsr
-falter-berlin-tunneldigger
-
-# Utils
-tcpdump-mini
 mtr
 ip
 iperf3
 tmux
 vnstat
 ethtool
+#dnsmasq is already provided via dnsmasq-full
+-dnsmasq
+qos-scripts
+firewall
 iwinfo
 libiwinfo-lua
+tcpdump-mini
+
+# falter Common
+falter-common
+falter-common-olsr
+falter-policyrouting
+falter-profiles
+falter-berlin-ssid-changer
 
 # GUI-basics
 uhttpd
 uhttpd-mod-ubus
 luci
 luci-ssl
+luci-app-ffwizard-falter
 luci-mod-falter
 luci-app-olsr
 luci-app-opkg
+luci-app-firewall
 luci-app-olsr-services
 luci-app-falter-owm
 luci-app-falter-owm-ant
@@ -46,9 +52,11 @@ luci-app-falter-owm-gui
 luci-proto-ppp
 luci-theme-bootstrap
 
-# GUI transalation stuff
+# GUI translation stuff
 luci-i18n-base-de
 luci-i18n-base-en
+luci-i18n-firewall-de
+luci-i18n-firewall-en
 luci-i18n-olsr-de
 luci-i18n-olsr-en
 luci-i18n-opkg-de
@@ -62,6 +70,17 @@ luci-i18n-ffwizard-falter-en
 luci-i18n-falter-policyrouting-de
 luci-i18n-falter-policyrouting-en
 
+# autoupdate
+falter-berlin-autoupdate
+falter-berlin-autoupdate-keys
+luci-app-falter-autoupdate
+luci-i18n-falter-autoupdate-de
+
+# service registrar
+falter-berlin-service-registrar
+luci-app-falter-service-registrar
+luci-i18n-falter-service-registrar-de
+
 # OLSR
 olsrd
 olsrd-utils
@@ -72,6 +91,9 @@ olsrd-mod-txtinfo
 olsrd-mod-nameservice
 kmod-ipip
 
+# Uplink
+falter-berlin-uplink-tunnelberlin
+
 # Statistics
 luci-app-statistics
 collectd
diff --git a/packageset/1.4.0/notunnel.txt b/packageset/1.4.0/notunnel.txt
index 2d7d26f..51bc524 100644
--- a/packageset/1.4.0/notunnel.txt
+++ b/packageset/1.4.0/notunnel.txt
@@ -1,5 +1,3 @@
--wpad-mini
-#wpad
 
 # Defaults
 falter-berlin-dhcp-defaults
@@ -16,7 +14,6 @@ falter-berlin-uhttpd-defaults
 mtr
 ip
 iperf3
-tmux
 vnstat
 ethtool
 #dnsmasq is already provided via dnsmasq-full
@@ -51,7 +48,7 @@ luci-app-falter-owm
 luci-app-falter-owm-ant
 luci-app-falter-owm-cmd
 luci-app-falter-owm-gui
-luci-proto-ppp
+-luci-proto-ppp
 luci-theme-bootstrap
 
 # GUI translation stuff
diff --git a/packageset/1.4.0/tunneldigger.txt b/packageset/1.4.0/tunneldigger.txt
index 8e59698..ce8d144 100644
--- a/packageset/1.4.0/tunneldigger.txt
+++ b/packageset/1.4.0/tunneldigger.txt
@@ -1,5 +1,3 @@
-#-wpad-mini
-#wpad
 
 # Defaults
 falter-berlin-dhcp-defaults
@@ -17,7 +15,6 @@ falter-profiles
 mtr
 ip
 iperf3
-tmux
 vnstat
 ethtool
 #dnsmasq is already provided via dnsmasq-full
@@ -50,7 +47,7 @@ luci-app-falter-owm
 luci-app-falter-owm-ant
 luci-app-falter-owm-cmd
 luci-app-falter-owm-gui
-luci-proto-ppp
+-luci-proto-ppp
 luci-theme-bootstrap
 
 # GUI translation stuff
diff --git a/packageset/1.5.0/backbone.txt b/packageset/1.5.0/backbone.txt
deleted file mode 100644
index 610f772..0000000
--- a/packageset/1.5.0/backbone.txt
+++ /dev/null
@@ -1 +0,0 @@
-falter-backbone
diff --git a/packageset/snapshot/backbone.txt b/packageset/snapshot/backbone.txt
deleted file mode 100644
index 610f772..0000000
--- a/packageset/snapshot/backbone.txt
+++ /dev/null
@@ -1 +0,0 @@
-falter-backbone
diff --git a/packageset/testbuildbot/backbone.txt b/packageset/testbuildbot/backbone.txt
deleted file mode 100644
index 610f772..0000000
--- a/packageset/testbuildbot/backbone.txt
+++ /dev/null
@@ -1 +0,0 @@
-falter-backbone
diff --git a/test/vm.sh b/test/vm.sh
index 719fd65..1e9a1fd 100755
--- a/test/vm.sh
+++ b/test/vm.sh
@@ -50,7 +50,7 @@ cat <<'EOF' >"$vmdir/vmconfig.json"
   },
   "boot-source": {
     "kernel_image_path": "./vmlinux",
-    "boot_args": "ro console=ttyS0 noapic reboot=k panic=1 pci=off nomodules random.trust_cpu=on i8042.noaux"
+    "boot_args": "ro console=ttyS0 reboot=k panic=1 pci=off nomodules random.trust_cpu=on i8042.noaux"
   },
   "drives": [
     {