I want to start using npf on my NetBSD server, rather than relying solely on the external firewall for protection. However, I get:

$ npfctl show
npfctl: /dev/npf: No such file or directory

Alright, maybe I deleted a device node. No matter:

$ grep npf /dev/MAKEDEV
        makedev bpf npf
        mkdev npf        c 198 0
# mknod /dev/npf c 198 0
$ npfctl show
npfctl: /dev/npf: Device not configured

Oh, right, have to load the driver first:

$ modstat | grep npf; echo $?
$ find /stand -name 'npf.kmod'
$ uname -sr
NetBSD 7.0.2
# modload npf
modload: Operation not permitted

Why am I (even as root) not permitted to load modules?

1 Answer 1


NetBSD uses kernel secure levels to determine what operations can be performed on a running system. From the link:

-1 Permanently insecure mode

  • Don't raise the securelevel on boot

0 Insecure mode

  • The init process (PID 1) may not be traced or accessed by ptrace(2), systrace(4), or procfs.
  • Immutable and append-only file flags may be changed
  • All devices may be read or written subject to their permissions

Note: You can't run X11 above this securelevel

Try sysutils/aperture if you really need it.

1 Secure mode

  • All effects of securelevel 0
  • /dev/mem and /dev/kmem may not be written to
  • Raw disk devices of mounted file systems are read-only
  • Immutable and append-only file flags may not be removed
  • Kernel modules may not be loaded or unloaded
  • The net.inet.ip.sourceroute sysctl(8) variable may not be changed
  • Adding or removing sysctl(9) nodes is denied
  • The RTC offset may not be changed
  • Set-id coredump settings may not be altered
  • Attaching the IP-based kernel debugger, ipkdb(4), is not allowed
  • Device pass-thru requests that may be used to perform raw disk and/or memory access are denied
  • iopl and ioperm calls are denied
  • Access to unmanaged memory is denied

2 Highly secure mode

  • All effects of securelevel 1
  • Raw disk devices are always read-only whether mounted or not
  • New disks may not be mounted, and existing mounts may only be downgraded from read-write to read-only
  • The system clock may not be set backwards or close to overflow
  • Per-process coredump name may not be changed
  • Packet filtering and NAT rules may not be altered

My system was running at securelevel 1, so "Kernel modules may not be loaded or unloaded". Further, setting npf=YES in rc.conf does not automatically load the associated kernel module. One cannot lower the kernel secure level at runtime, so the options are:

  • Boot to a lower securelevel, then load the module and raise the securelevel, or
  • Load the module during boot

Clearly the latter is the better option. To load a kernel module at boot, one must ensure that rc.conf contains:


Then, edit (or create) /etc/modules.conf to contain a list of modules to load, one per line. In this case:

# echo npf >> /etc/modules.conf

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .