I want to start using npf on my NetBSD server, rather than relying solely on the external firewall for protection. However, I get:

$ npfctl show
npfctl: /dev/npf: No such file or directory

Alright, maybe I deleted a device node. No matter:

$ grep npf /dev/MAKEDEV
        makedev bpf npf
        mkdev npf        c 198 0
# mknod /dev/npf c 198 0
$ npfctl show
npfctl: /dev/npf: Device not configured

Oh, right, have to load the driver first:

$ modstat | grep npf; echo $?
$ find /stand -name 'npf.kmod'
$ uname -sr
NetBSD 7.0.2
# modload npf
modload: Operation not permitted

Why am I (even as root) not permitted to load modules?

1 Answer 1


NetBSD uses kernel secure levels to determine what operations can be performed on a running system. From the link:

-1 Permanently insecure mode

  • Don't raise the securelevel on boot

0 Insecure mode

  • The init process (PID 1) may not be traced or accessed by ptrace(2), systrace(4), or procfs.
  • Immutable and append-only file flags may be changed
  • All devices may be read or written subject to their permissions

Note: You can't run X11 above this securelevel

Try sysutils/aperture if you really need it.

1 Secure mode

  • All effects of securelevel 0
  • /dev/mem and /dev/kmem may not be written to
  • Raw disk devices of mounted file systems are read-only
  • Immutable and append-only file flags may not be removed
  • Kernel modules may not be loaded or unloaded
  • The net.inet.ip.sourceroute sysctl(8) variable may not be changed
  • Adding or removing sysctl(9) nodes is denied
  • The RTC offset may not be changed
  • Set-id coredump settings may not be altered
  • Attaching the IP-based kernel debugger, ipkdb(4), is not allowed
  • Device pass-thru requests that may be used to perform raw disk and/or memory access are denied
  • iopl and ioperm calls are denied
  • Access to unmanaged memory is denied

2 Highly secure mode

  • All effects of securelevel 1
  • Raw disk devices are always read-only whether mounted or not
  • New disks may not be mounted, and existing mounts may only be downgraded from read-write to read-only
  • The system clock may not be set backwards or close to overflow
  • Per-process coredump name may not be changed
  • Packet filtering and NAT rules may not be altered

My system was running at securelevel 1, so "Kernel modules may not be loaded or unloaded". Further, setting npf=YES in rc.conf does not automatically load the associated kernel module. One cannot lower the kernel secure level at runtime, so the options are:

  • Boot to a lower securelevel, then load the module and raise the securelevel, or
  • Load the module during boot

Clearly the latter is the better option. To load a kernel module at boot, one must ensure that rc.conf contains:


Then, edit (or create) /etc/modules.conf to contain a list of modules to load, one per line. In this case:

# echo npf >> /etc/modules.conf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.