diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40be18c..916ca8a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog for lede-dockerbuilder
 
+## v3.3 [2022-09-19]
+
+* Upgrade to OpenWrt 22.03.0
+* add script to run x86_64 image in qemu
+
 ## v3.2 [2022-08-07]
 
 * build image using nix-shell, which does not require a container
diff --git a/README.md b/README.md
index 11131b6..d91ab0a 100644
--- a/README.md
+++ b/README.md
@@ -31,8 +31,7 @@ for your embedded device or a Raspberry PI) using a self-contained docker
 container or a [nix-shell](https://nixos.wiki/wiki/Development_environment_with_nix-shell) and the [OpenWrt image
 builder](https://openwrt.org/docs/guide-user/additional-software/imagebuilder).
 On the builder host, Docker, podman/buildah (for dockerless operation) or nix-shell is the
-only requirement. Supports latest OpenWrt release (21.02.3) and upcomig 22.03.x
-release ([example](example-x86_64-22.03.x.conf)).
+only requirement. Supports latest OpenWrt release (22.03.0).
 
 ### Note
 
@@ -188,7 +187,7 @@ encrypted USB disk attached so I can use it as a simple NAS with samba and ftp:
 ```
 # LEDE profile to use: NEXX WT3020
 LEDE_PROFILE=nexx_wt3020-8m
-LEDE_RELEASE=21.02.3
+LEDE_RELEASE=22.03.0
 LEDE_TARGET=ramips
 LEDE_SUBTARGET=mt7620
 
@@ -278,8 +277,11 @@ These examples evolved from images I use myself.
 * [image with samba, vsftpd and encrypted usb disk for
   NEXX-WT3020](example-nexx-wt3020.conf). Is the predessor of ...
 * [image with samba, vsftpd and encrypted usb disk for
-  GINET-GL-M300N V2](example-glinet-gl-mt300n-v2.conf). This is my travel router
-  setup where I have an encrypted USB disk connected to the router.
+  GINET-GL-M300N V2](example-glinet-gl-mt300n-v2.conf). Is the predessor of ...
+* [image with samba, vsftpd, adblock and encrypted usb disk for
+  GINET-GL-AR750](example-glinet-gl-ar750.conf). This is my travel router
+  setup where I have an encrypted USB disk connected to the router, accessible
+  through SMB or FTP and have an adblocker running. Useful if you travel much.
 
 To build an example run `./builder.sh build <config-file>`, e.g.
 
@@ -298,10 +300,11 @@ x86_64 based OpenWrt image which can also be run in qemu, e.g. if you need
 a virtual router/firewall.
 
 First build the image with `builder.sh build example-x86_64.conf`, then unpack
-the resulting image with `gunzip output/openwrt-19.07.x-x86-64-combined-ext4.img.gz`.
-Now the image can be started with qemu:
+the resulting image with e.g. `gunzip
+output/openwrt-22.03.0-x86-64-generic-ext4-combined.img.gz`.  Finally the image
+can be started with qemu (or simply use [run_in_qemu.sh](etc/run_in_qemu.sh))
 
-```
+```shell
 qemu-system-x86_64 \
     -enable-kvm \
     -nographic \
diff --git a/etc/run_in_qemu.sh b/etc/run_in_qemu.sh
new file mode 100755
index 0000000..d95342e
--- /dev/null
+++ b/etc/run_in_qemu.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# run x86_64 image in qemu. 
+# usage:
+#   run_in_qemu.sh [path-to-combined-ext4-image]
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+IMG=${1:-$SCRIPT_DIR/../output/openwrt-22.03.0-x86-64-generic-ext4-combined.img}
+
+exec qemu-system-x86_64 \
+    -enable-kvm \
+    -nographic \
+    -device ide-hd,drive=d0,bus=ide.0 \
+    -netdev user,id=hn0 \
+    -device virtio-net-pci,netdev=hn0,id=wan \
+    -netdev user,id=hn1,hostfwd=tcp::5555-:22001 \
+    -device virtio-net-pci,netdev=hn1,id=lan \
+    -drive id=d0,if=none,file="$IMG"
+
diff --git a/example-glinet-gl-ar750.conf b/example-glinet-gl-ar750.conf
index cff642b..3846d9a 100644
--- a/example-glinet-gl-ar750.conf
+++ b/example-glinet-gl-ar750.conf
@@ -1,6 +1,6 @@
 # LEDE profile to use: GL.iNet GL-AR750
 LEDE_PROFILE=glinet_gl-ar750
-LEDE_RELEASE=22.03.0-rc6
+LEDE_RELEASE=22.03.0
 LEDE_TARGET=ath79
 LEDE_SUBTARGET=generic
 
@@ -15,6 +15,6 @@ LEDE_PACKAGES="-ath10k-firmware-qca9887-ct ath10k-firmware-qca9887-ct-full-htt \
     kmod-crypto-user iwinfo dropbear \
     -ppp -kmod-ppp -kmod-pppoe -kmod-pppox -ppp-mod-pppoe nmap tcpdump\
     kmod-wireguard luci-app-wireguard luci-proto-wireguard wireguard-tools\
-    luci-ssl lsblk"
+    luci-ssl lsblk adblock luci-app-adblock"
 
 LEDE_DISABLED_SERVICES=""
diff --git a/example-nexx-wt3020.conf b/example-nexx-wt3020.conf
index e650f31..3f69b73 100644
--- a/example-nexx-wt3020.conf
+++ b/example-nexx-wt3020.conf
@@ -1,6 +1,6 @@
 # LEDE profile to use: NEXX WT3020
 LEDE_PROFILE=nexx_wt3020-8m
-LEDE_RELEASE=21.02.3
+LEDE_RELEASE=22.03.0
 LEDE_TARGET=ramips
 LEDE_SUBTARGET=mt7620
 
@@ -9,13 +9,13 @@ LEDE_SUBTARGET=mt7620
 # include all packages to build a mobile NAS supporting disk encryption:
 # ksmbd (samba4 is too large now for the WT3020's 8MB), cryptsetup.
 # see https://github.com/namjaejeon/ksmbd-tools for ksmbd info.
-LEDE_PACKAGES="ksmbd-server ksmbd-utils lsblk iwinfo tcpdump block-mount\
-    kmod-usb-storage-uas kmod-scsi-core kmod-fs-ext4 ntfs-3g\
-    kmod-nls-cp437 kmod-nls-iso8859-1 cryptsetup kmod-crypto-xts\
+LEDE_PACKAGES="ksmbd-server ksmbd-utils lsblk block-mount\
+    kmod-usb-storage-uas kmod-scsi-core ntfs-3g\
+    kmod-nls-iso8859-1 cryptsetup kmod-crypto-xts\
     kmod-mt76 kmod-usb2 kmod-usb-ohci kmod-usb-core kmod-dm kmod-crypto-ecb\
     kmod-crypto-misc kmod-crypto-cbc kmod-crypto-crc32c kmod-crypto-hash\
     kmod-crypto-user\
-    -ppp -kmod-ppp -kmod-pppoe -kmod-pppox -ppp-mod-pppoe\
+    -ppp -kmod-ppp -kmod-pppoe -kmod-pppox -ppp-mod-pppoe -opkg\
     -ip6tables -odhcp6c -kmod-ipv6 -kmod-ip6tables -odhcpd-ipv6only"
 
 # optionally override OUTPUT_DIR and ROOTFS_OVERLAY directory location here
diff --git a/example-rpi2.conf b/example-rpi2.conf
index 74cde6c..c3db159 100644
--- a/example-rpi2.conf
+++ b/example-rpi2.conf
@@ -1,10 +1,13 @@
 LEDE_PROFILE=rpi-2
-LEDE_RELEASE=21.02.3
+LEDE_RELEASE=22.03.0
 LEDE_TARGET=bcm27xx
 LEDE_SUBTARGET=bcm2709
 
 # list packages to include in LEDE image. prepend packages to deinstall with "-".
-LEDE_PACKAGES="base-files busybox dropbear mtd uci opkg netifd fstools uclient-fetch logd kmod-usb-hid kmod-sound-core kmod-sound-arm-bcm2835 kmod-fs-vfat kmod-nls-cp437 kmod-nls-iso8859-1 dnsmasq iptables ip6tables ppp ppp-mod-pppoe firewall luci-ssl-nginx"
+LEDE_PACKAGES="base-files busybox dropbear mtd uci opkg netifd fstools uclient-fetch \
+               logd kmod-usb-hid kmod-sound-core kmod-sound-arm-bcm2835 \
+               kmod-fs-vfat kmod-nls-cp437 kmod-nls-iso8859-1 dnsmasq \
+               -ppp -ppp-mod-pppoe luci-ssl-nginx"
 
 # optionally override OUTPUT_DIR and ROOTFS_OVERLAY directory location here
 
diff --git a/example-rpi4.conf b/example-rpi4.conf
index e37fcbb..2859df4 100644
--- a/example-rpi4.conf
+++ b/example-rpi4.conf
@@ -1,9 +1,11 @@
 # Demo for Raspberry 4.
 LEDE_PROFILE=rpi-4
-LEDE_RELEASE=21.02.3
+LEDE_RELEASE=22.03.0
 LEDE_TARGET=bcm27xx
 LEDE_SUBTARGET=bcm2711
 
 # list packages to include in LEDE image. prepend packages to deinstall with "-".
-LEDE_PACKAGES="base-files busybox dropbear mtd uci opkg netifd fstools uclient-fetch logd kmod-usb-hid kmod-sound-core kmod-fs-vfat kmod-nls-cp437 kmod-nls-iso8859-1 dnsmasq iptables ip6tables ppp ppp-mod-pppoe firewall luci-ssl-nginx luci-app-adblock adblock"
+LEDE_PACKAGES="dropbear mtd uci opkg netifd fstools uclient-fetch kmod-usb-hid \
+               kmod-sound-core kmod-fs-vfat kmod-nls-cp437 kmod-nls-iso8859-1 \
+               dnsmasq -ppp -ppp-mod-pppoe luci-ssl-nginx luci-app-adblock adblock"
 
diff --git a/example-wrt1043nd.conf b/example-wrt1043nd.conf
index 71a35c0..897d024 100644
--- a/example-wrt1043nd.conf
+++ b/example-wrt1043nd.conf
@@ -1,7 +1,7 @@
 # OpenWRT profile to use: tp link WR1043ND
 LEDE_PROFILE=tplink_tl-wr1043nd-v2
 LEDE_TARGET=ath79
-LEDE_RELEASE=21.02.3
+LEDE_RELEASE=22.03.0
 LEDE_SUBTARGET=generic
 
 # list packages to include in the image. prepend packages to deinstall with "-".
diff --git a/example-x86_64.conf b/example-x86_64.conf
index 8e12199..754fa14 100644
--- a/example-x86_64.conf
+++ b/example-x86_64.conf
@@ -2,12 +2,12 @@
 # See README.md for info on running this image with QEMU.
 #
 LEDE_PROFILE=generic
-LEDE_RELEASE=21.02.3
+LEDE_RELEASE=22.03.0
 LEDE_TARGET=x86
 LEDE_SUBTARGET=64
 
 # list packages to include in LEDE image. prepend packages to deinstall with "-".
-LEDE_PACKAGES="base-files busybox dropbear mtd uci opkg netifd fstools uclient-fetch logd kmod-usb-hid dnsmasq iptables ip6tables firewall luci-ssl-nginx"
+LEDE_PACKAGES="dropbear mtd opkg netifd fstools uclient-fetch kmod-usb-hid dnsmasq luci-ssl-nginx"
 
 # optionally override OUTPUT_DIR and ROOTFS_OVERLAY directory location here