diff --git a/netmap/policy.go b/netmap/policy.go
index 06e1cba..323050e 100644
--- a/netmap/policy.go
+++ b/netmap/policy.go
@@ -471,7 +471,7 @@ func writeFilterStringTo(w io.StringWriter, f netmap.Filter) error {
 	unspecified := op == 0
 
 	if s = f.GetKey(); s != "" {
-		_, err = w.WriteString(fmt.Sprintf("%s %s %s", s, op, f.GetValue()))
+		_, err = w.WriteString(fmt.Sprintf("%s %s %s", escapeString(s), op, escapeString(f.GetValue())))
 		if err != nil {
 			return err
 		}
@@ -816,3 +816,12 @@ func operationFromString(s string) (op netmap.Operation) {
 
 	return
 }
+
+// escapeString returns single quote wrapped string if it contains special
+// characters '-' and whitespace.
+func escapeString(s string) string {
+	if strings.ContainsAny(s, " -\t") {
+		return "'" + s + "'"
+	}
+	return s
+}