diff --git a/net/openfortivpn/files/openfortivpn-wrapper b/net/openfortivpn/files/openfortivpn-wrapper
index 681ec87513..ee9214b26d 100755
--- a/net/openfortivpn/files/openfortivpn-wrapper
+++ b/net/openfortivpn/files/openfortivpn-wrapper
@@ -23,19 +23,19 @@ trap_with_arg() {
 func_trap() {
 	logger "openfortivpn-wrapper[$$]" "$config: sending signal ${1}"
 	killed=1
-	kill -${1} $child 2>/dev/null
+	kill "-${1}" "$child" 2>/dev/null
 }
 
 trap_with_arg func_trap INT TERM KILL
 
 
 start_time=$(date '+%s')
-/usr/sbin/openfortivpn "$@" < $pwfile 2>/dev/null &
+/usr/sbin/openfortivpn "$@" < "$pwfile" 2>/dev/null &
 child=$!
 wait $child || {
 	[ "$killed" = 1 ] && exit 0
 	current_time=$(date '+%s')
-	elapsed=$(($current_time-$start_time))
+	elapsed=$((current_time-start_time))
 	. /lib/netifd/netifd-proto.sh
 	proto_notify_error "$config" "Failed to connect after $elapsed seconds."
 	proto_block_restart "$config"
diff --git a/net/openfortivpn/files/openfortivpn.sh b/net/openfortivpn/files/openfortivpn.sh
index 3c5aad02e9..098d7546b7 100755
--- a/net/openfortivpn/files/openfortivpn.sh
+++ b/net/openfortivpn/files/openfortivpn.sh
@@ -30,7 +30,7 @@ proto_openfortivpn_setup() {
 
 	local msg ifname ip server_ips pwfile callfile
 
-	local host peeraddr port tunlink local_ip username password trusted_cert \
+	local peeraddr port tunlink local_ip username password trusted_cert \
 	      remote_status_check
 	json_get_vars host peeraddr port tunlink local_ip username password trusted_cert \
 		      remote_status_check
@@ -41,7 +41,7 @@ proto_openfortivpn_setup() {
 	[ -n "$tunlink" ] && {
 		network_get_device iface_device_name "$tunlink"
 		network_is_up "$tunlink"  || {
-			msg="$tunlink is not up $iface_device_up"
+			msg="$tunlink is not up $iface_device_name"
 			logger -t "openfortivpn" "$config: $msg"
 			proto_notify_error "$config" "$msg"
 			proto_block_restart "$config"
@@ -52,8 +52,7 @@ proto_openfortivpn_setup() {
 	if echo "$peeraddr" | grep -q -E "$IPv4_REGEX"; then
 		server_ips="$peeraddr"
 	elif command -v resolveip >/dev/null ; then
-		server_ips="$(resolveip -4 -t 10 "$peeraddr")"
-		[ $? -eq 0 ] || {
+		server_ips="$(resolveip -4 -t 10 "$peeraddr")" || {
 			msg="$config: failed to resolve server ip for $peeraddr"
 			logger -t "openfortivpn" "$msg"
 			sleep 10
@@ -67,7 +66,7 @@ proto_openfortivpn_setup() {
 
 
 	[ "$remote_status_check" = "curl" ] && {
-		curl -k --head -s --connect-timeout 10 ${tunlink:+--interface} $iface_device_name https://$peeraddr > /dev/null || {
+		curl -k --head -s --connect-timeout 10 ${tunlink:+--interface} "$iface_device_name" "https://$peeraddr" > /dev/null || {
 			msg="failed to reach https://$peeraddr${tunlink:+ on $iface_device_name}"
 			logger -t "openfortivpn" "$config: $msg"
 			sleep 10
@@ -77,7 +76,7 @@ proto_openfortivpn_setup() {
 		}
 	}
 	[ "$remote_status_check" = "ping" ]  && {
-		ping ${tunlink:+-I} $iface_device_name -c 1 -w 10 $peeraddr > /dev/null 2>&1 || {
+		ping ${tunlink:+-I} "$iface_device_name" -c 1 -w 10 "$peeraddr" > /dev/null 2>&1 || {
 			msg="$config: failed to ping $peeraddr on $iface_device_name"
 			logger -t "openfortvpn" "$config: $msg"
 			sleep 10
@@ -96,7 +95,7 @@ proto_openfortivpn_setup() {
 
 	# uclient-fetch cannot bind to interface, so perform check after adding host dependency
 	[ "$remote_status_check" = "fetch" ]  && {
-		uclient-fetch --no-check-certificate -q -s --timeout=10 https://$peeraddr > /dev/null 2>&1 || {
+		uclient-fetch --no-check-certificate -q -s --timeout=10 "https://$peeraddr" > /dev/null 2>&1 || {
 			msg="$config: failed to reach ${server_ip:-$peeraddr} on $iface_device_name"
 			logger -t "openfortvpn" "$config: $msg"
 			sleep 10
@@ -147,7 +146,7 @@ ipparam $config
 lcp-max-configure 40
 ip-up-script /lib/netifd/openfortivpn-ppp-up
 ip-down-script /lib/netifd/ppp-down
-mru 1354"  > $callfile
+mru 1354"  > "$callfile"
 	append_args "--pppd-call=openfortivpn/$config"
 
 	logger -p 6 -t openfortivpn "$config: executing 'openfortivpn $cmdline'"
@@ -161,8 +160,8 @@ proto_openfortivpn_teardown() {
 	pwfile="/var/etc/openfortivpn/$config.passwd"
 	callfile="/var/etc/openfortivpn/peers/$config"
 
-	rm -f $pwfile
-	rm -f $callfile
+	rm -f "$pwfile"
+	rm -f "$callfile"
 	proto_kill_command "$config" 2
 }