diff --git a/src/packages/fff/fff-hoods/files/usr/sbin/configurehood b/src/packages/fff/fff-hoods/files/usr/sbin/configurehood
index 90d81d1..c1c8eeb 100755
--- a/src/packages/fff/fff-hoods/files/usr/sbin/configurehood
+++ b/src/packages/fff/fff-hoods/files/usr/sbin/configurehood
@@ -85,6 +85,7 @@ else
 		#UPLINK: No uplink download if internet present
 		#if no Internet, we connect to the hidden AP and download the file from another Node in range
 	else
+		/usr/sbin/vpn-stop # Stop VPN processes if router has no internet
 		# connect to wireless hidden ap here and download the json File from the nearest router
 		# Only do that, when we have no gateway in range. If the Uplinkrouter changed the hood, we lost the GW and do this automatically again, I think! Nice idea?
 		if ! isGatewayAvailable ; then
@@ -197,6 +198,8 @@ if [ -s "$hoodfile" ]; then
 	if [ "$sumnew" != "$sumold" ] ; then
 		echo "New file detected, we reconfigure the Node";
 
+		/usr/sbin/vpn-stop # stop VPN during reconfiguration (so we can start again with new config)
+		
 		json_select hood
 
 		json_get_var hood name
@@ -270,6 +273,8 @@ if [ -s "$hoodfile" ]; then
 		newntp="${ntpip}" # requires routable address, no link-local
 		[ "$newntp" = "$oldntp" ] || setTimeserver "${newntp}" # only rewrite if changed
 
+		/usr/sbin/vpn-configure # Configure VPN, but do not start it
+
 		# copy the file to webroot so that other mesh routers can download it;
 		# copy only after all other steps so IF can be reentered if something goes wrong
 		cp "$hoodfile" "$hoodfilecopy"
@@ -281,12 +286,9 @@ if [ -s "$hoodfile" ]; then
 		echo "We have no new file. We do nothing. We try it again in 5 minutes...";
 	fi
 	
-	# and now we get to vpn-select script and load VPNs directly from /tmp/keyxchangev2data
+	# Start already configured VPN if router has internet
+	hasInternet && /usr/sbin/vpn-start
 	
-	if hasInternet ; then
-		sh /usr/sbin/vpn-select
-	fi
-
 	# now we load the prefix from the hoodfile and set this to br-mesh
 	json_select network
 	json_get_var prefix ula_prefix
diff --git a/src/packages/fff/fff-vpn-select/Makefile b/src/packages/fff/fff-vpn-select/Makefile
index 4e2d89b..27cff09 100644
--- a/src/packages/fff/fff-vpn-select/Makefile
+++ b/src/packages/fff/fff-vpn-select/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=fff-vpn-select
-PKG_VERSION:=1
+PKG_VERSION:=3
 PKG_RELEASE:=1
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)
diff --git a/src/packages/fff/fff-vpn-select/files/lib/functions/fff/vpn-select b/src/packages/fff/fff-vpn-select/files/lib/functions/fff/vpn-select
new file mode 100644
index 0000000..72022f4
--- /dev/null
+++ b/src/packages/fff/fff-vpn-select/files/lib/functions/fff/vpn-select
@@ -0,0 +1,100 @@
+#!/bin/sh
+# Copyright 2018 Adrian Schmutzler
+# License GPLv3
+
+. /lib/functions/fff/keyxchange
+. /usr/share/libubox/jshn.sh
+
+make_config() {
+	# Create VPN config
+	#
+	# Call without parameters
+
+	index_l2tp=0
+	index_json=1
+	json_load "$(cat "$hoodfile")"
+	json_select vpn
+	# get VPN peers
+	while json_select "$index_json" > /dev/null
+	do
+		json_get_var protocol protocol
+		# Current design requires "fastd" for both fastd and L2TP, decision is made by gateway
+		if [ "$protocol" == "fastd" ]; then
+			json_get_var servername name
+			json_get_var key key
+			json_get_var address address
+			json_get_var port port
+			
+			if [ "l2tp" = "$(wget -T10 "${address}/vpn.txt" -O - 2>/dev/null)" ]; then
+				# Setup L2TP
+				make_l2tp "$address" "$port" "$index_l2tp"
+				index_l2tp=$((index_l2tp + 1))
+			else
+				# Setup fastd
+				make_fastd "$servername" "$address" "$port" "$key"
+			fi
+		fi
+		json_select ".." # back to vpn
+		index_json=$(( index_json + 1 ))
+	done
+	json_select ".." # back to root
+}
+
+make_fastd() {
+	# Create fastd config
+	#
+	# Syntax: make_fastd <servername> <address> <port> <key>
+
+	if [ $# -ne "4" ]
+	then
+		return 1
+	fi
+
+	local servername=$1
+	local address=$2
+	local port=$3
+	local key=$4
+
+	filename="/etc/fastd/fff/peers/$servername"
+	echo "#name \"${servername}\";" > "$filename"
+	echo "key \"${key}\";" >> "$filename"
+	echo "remote ipv4 \"${address}\" port ${port};" >> "$filename"
+	echo "" >> "$filename"
+	echo "float yes;" >> "$filename"
+	
+	return 0
+}
+
+make_l2tp() {
+	# Create L2TP config
+	#
+	# Syntax: make_l2tp <address> <port> <count>
+
+	if [ $# -ne "3" ]
+	then
+		return 1
+	fi
+
+	local address=$1
+	local port=$2
+	local count=$3
+
+	# Use MAC address as hostname if not set
+	hostname="$(cat /proc/sys/kernel/hostname)"
+	[ "$hostname" = "LEDE" ] && hostname=""
+	[ "$hostname" = "" ] && hostname="$(awk '{ mac=toupper($1); gsub(":", "", mac); print mac }' /sys/class/net/br-mesh/address 2>/dev/null)"
+
+	L2PORT=$((port + 10000))
+
+	uci -q set "tunneldigger.$count=broker"
+	uci -q set "tunneldigger.$count.address=${address}:$L2PORT"
+	uci -q set "tunneldigger.$count.uuid=$hostname"
+	uci -q set "tunneldigger.$count.interface=l2tp$count"
+	uci -q set "tunneldigger.$count.enabled=1"
+	uci -q set "tunneldigger.$count.hook_script=/etc/tunneldigger/tunneldigger.hook"
+	uci -c /tmp commit tunneldigger
+	
+	return 0
+}
+
+# vim: set noexpandtab:tabstop=4
diff --git a/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-configure b/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-configure
new file mode 100755
index 0000000..cb488ce
--- /dev/null
+++ b/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-configure
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+. /lib/functions/fff/vpn-select
+
+# remove old config in any case
+>/etc/config/tunneldigger
+[ ! -d /tmp/fastd_fff_peers ] && mkdir /tmp/fastd_fff_peers
+rm /tmp/fastd_fff_peers/*
+
+# Only write config if hood file is present and greater 0 byte
+[ -s "$hoodfile" ] && make_config
diff --git a/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-select b/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-select
deleted file mode 100755
index 85930a8..0000000
--- a/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-select
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/bin/sh
-
-. /lib/functions/fff/keyxchange
-. /usr/share/libubox/jshn.sh
-
-make_config() {
-# remove old config
->/etc/config/tunneldigger
-rm /tmp/fastd_fff_peers/*
-count=0
-Index=1
-json_load "$(cat "$hoodfile")"
-json_select vpn
-# get fastd peers
-while json_select "$Index" > /dev/null
-do
-	json_get_var protocol protocol
-	if [ "$protocol" == "fastd" ]; then
-		json_get_var servername name
-		filename="/etc/fastd/fff/peers/$servername"
-		echo "#name \"${servername}\";" > "$filename"
-		json_get_var key key
-		echo "key \"${key}\";" >> "$filename"
-		json_get_var address address
-		json_get_var port port
-		echo "remote ipv4 \"${address}\" port ${port};" >> "$filename"
-		echo "" >> "$filename"
-		echo "float yes;" >> "$filename"
-		
-		# ask for Broker and select the tunnel
-		if [ "l2tp" = "$(wget -T10 "${address}/vpn.txt" -O - 2>/dev/null)" ]; then
-			# Gateway offers l2tp
-			L2PORT=$((port + 10000))
-			UUID=$hostname
-
-			uci set tunneldigger.$count=broker
-			uci set tunneldigger.$count.address="${address}:$L2PORT"
-			uci set tunneldigger.$count.uuid="$UUID"
-			uci set tunneldigger.$count.interface="l2tp$count"
-			uci set tunneldigger.$count.enabled="1"
-			uci set tunneldigger.$count.hook_script='/etc/tunneldigger/tunneldigger.hook'
-			uci -c /tmp commit tunneldigger
-			count=$((count + 1))
-			# remove this fastd-peer
-			rm "$filename"
-		fi
-	fi
-	json_select ".." # back to vpn
-	Index=$(( Index + 1 ))
-done
-json_select ".." # back to root
-}
-
-# main
-
-# Only do something when file is here and greater 0 byte
-if [ -s "$hoodfile" ]; then
-	# set some vars
-	hostname=$(cat /proc/sys/kernel/hostname)
-	mac=$(awk '{ mac=toupper($1); gsub(":", "", mac); print mac }' /sys/class/net/br-mesh/address 2>/dev/null)
-	[ "$hostname" = "LEDE" ] && hostname=""
-	[ "$hostname" = "" ] &&  hostname="$mac"
-
-	if [ ! -d /tmp/fastd_fff_peers ]; then
-		# first run after reboot
-		mkdir /tmp/fastd_fff_peers
-		make_config
-		# start fastd only if there are some peers left
-		[ "$(ls /etc/fastd/fff/peers/* 2>/dev/null)" ] && /etc/init.d/fastd start
-		/etc/init.d/tunneldigger start
-	else
-		# check if new tunneldigger conf is different
-		sumold=$(sha256sum /etc/config/tunneldigger)
-		make_config
-		sumnew=$(sha256sum /etc/config/tunneldigger)
-		[ "$sumnew" != "$sumold" ] && /etc/init.d/tunneldigger restart
-		/etc/init.d/fastd reload
-
-		# fastd start/stop for various situations
-		pidfile="/tmp/run/fastd.fff.pid"
-		if [ "$(ls /etc/fastd/fff/peers/* 2>/dev/null)" ]; then
-			([ -s "$pidfile" ] && [ -d "/proc/$(cat "$pidfile")" ]) || /etc/init.d/fastd start
-		else
-			([ -s "$pidfile" ] && [ -d "/proc/$(cat "$pidfile")" ]) && /etc/init.d/fastd stop
-		fi
-	fi
-fi
diff --git a/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-start b/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-start
new file mode 100755
index 0000000..592b871
--- /dev/null
+++ b/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-start
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if [ "$(ls /etc/fastd/fff/peers/* 2>/dev/null)" ] ; then
+	pidfile="/tmp/run/fastd.fff.pid"
+	([ -s "$pidfile" ] && [ -d "/proc/$(cat "$pidfile")" ]) || /etc/init.d/fastd start
+fi
+
+uci -q get tunneldigger.@broker[0] > /dev/null && /etc/init.d/tunneldigger start
diff --git a/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-stop b/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-stop
new file mode 100755
index 0000000..f931d7e
--- /dev/null
+++ b/src/packages/fff/fff-vpn-select/files/usr/sbin/vpn-stop
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+/etc/init.d/tunneldigger stop
+
+pidfile="/tmp/run/fastd.fff.pid"
+([ -s "$pidfile" ] && [ -d "/proc/$(cat "$pidfile")" ]) && /etc/init.d/fastd stop
