Load OS Fingerprints for iptables with nfnl_osf

nfnl_osf pushes OS fingerprint data into the kernel so iptables' osf match has something to compare packets against, nothing more. You will load a fingerprint file, check the command actually succeeded, and remove the same signatures again once you are done. The examples use nfnl_osf from the Ubuntu iptables package version 1.8.10-3ubuntu2.

Allow about fifteen minutes. You need a root shell or sudo, the iptables package, and a fingerprint file in the format this utility expects. Loading signatures changes kernel state, so test on the host that will actually use the osf match, and record the exact file path. This guide does not add or activate an iptables rule.

1. Confirm the Installed Utility

Check which executable and package version you have first, these are read-only and need no elevated privileges:

$ command -v nfnl_osf
/usr/sbin/nfnl_osf
$ dpkg-query -W -f='${Package} ${Version}\n' iptables
iptables 1.8.10-3ubuntu2

Ask the command to show its usage too:

$ nfnl_osf
... Missing fingerprints file argument.

The exact wording can vary with the build. What matters is that -f is required, the command never picks a default fingerprint file for you.

2. Get and Inspect a Fingerprint File

The manual points at OpenBSD's pf.os as a source of up-to-date OS signatures. The old CVS address in this installed manual now just errors out, so use the read-only mirror of the official OpenBSD source repository instead:

$ curl --fail --location --output /tmp/pf.os \
    https://raw.githubusercontent.com/openbsd/src/master/etc/pf.os
$ test -s /tmp/pf.os && echo 'fingerprint file is non-empty'
fingerprint file is non-empty

Inspect the download before you load it. Treat a download error, an HTML error page, or an unexpected format as a hard stop:

$ file /tmp/pf.os
$ sed -n '1,12p' /tmp/pf.os

The URL is an upstream source, not a promise that every future revision suits every kernel. Keep a copy of the exact file you use for a deployment, and never load a file just because it has the right name.

3. Load the Signatures Into the Kernel

Loading is a privileged, state-changing operation. Check the path one more time, then run:

$ sudo nfnl_osf -f /tmp/pf.os
$ printf 'nfnl_osf exit status: %s\n' "$?"
nfnl_osf exit status: 0

The utility reads signatures from the file and adds them to the kernel for iptables' osf match to use later. A clean exit status is the main verification you get, it may print nothing on success. A non-zero result means loading did not complete, do not carry on as though the signatures are available.

if sudo nfnl_osf -f /tmp/pf.os; then
    echo 'OS fingerprints loaded'
else
    status=$?
    printf 'nfnl_osf failed with status %s\n' "$status" >&2
    exit "$status"
fi

4. Keep Matching Separate From Loading

nfnl_osf only loads or removes signatures, it never creates an iptables policy. The related osf match belongs in a rule you have reviewed for your firewall's actual traffic path and default policy. Never paste a guessed rule into a production firewall just to see whether loading worked.

Loading fingerprints is also not proof anything will get identified. Matching depends on traffic actually reaching the rule and on the signatures the kernel has available. Test the full rule in a maintenance window, with a rollback ready for the rule itself.

5. Remove the Same Signatures

To undo this, use the same fingerprint file with -d. This is also privileged and changes kernel state:

$ sudo nfnl_osf -d -f /tmp/pf.os
$ printf 'nfnl_osf exit status: %s\n' "$?"
nfnl_osf exit status: 0

Keep the file until removal succeeds, a different revision may not describe exactly what was loaded, so do not discard the original after a successful load. If removal fails, keep the file and its error output, and investigate before rebooting or loading anything else.

This workflow writes no persistent configuration file. If you need the signatures to survive a reboot, set that up through your distribution's documented firewall or service mechanism, and make sure you understand its startup ordering. A successful one-off load does not survive a reboot on its own.

6. Diagnose Failures Without Guessing

The manual splits failures into a few useful classes. A missing -f argument is an argument error. An unreadable file or failed netlink communication is reported as an error. An invalid fingerprint format or a netlink handle initialisation failure is a different class again. The numeric error your shell or wrapper shows you is less useful than the command's own diagnostic and exit status, so keep both.

$ sudo nfnl_osf -f /path/that/does/not/exist
... fingerprints file not readable ...
$ printf 'nfnl_osf exit status: %s\n' "$?"
nfnl_osf exit status: 255

The exact text and negative return-code representation can differ between the utility and the shell. Check the file without changing anything:

$ ls -l /path/to/fingerprints
$ test -r /path/to/fingerprints && echo readable
$ file /path/to/fingerprints

Do not fix a format or netlink error by loading the file again and again. Stop, keep the file, and compare it against the installed manual and the kernel support on that host.