\" $NetBSD: npf.conf.5,v 1.98 2025/07/02 18:52:35 gutteridge Exp $
\"
\" Copyright (c) 2009-2025 The NetBSD Foundation, Inc.
\" All rights reserved.
\"
\" This material is based upon work partially supported by The
\" NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
\"
\" Redistribution and use in source and binary forms, with or without
\" modification, are permitted provided that the following conditions
\" are met:
\" 1. Redistributions of source code must retain the above copyright
\" notice, this list of conditions and the following disclaimer.
\" 2. Redistributions in binary form must reproduce the above copyright
\" notice, this list of conditions and the following disclaimer in the
\" documentation and/or other materials provided with the distribution.
\"
\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
\" POSSIBILITY OF SUCH DAMAGE.
\"
Dd July 2, 2025
Dt NPF.CONF 5
Os
Sh NAME
Nm npf.conf
Nd NPF packet filter configuration file
\" -----
Sh DESCRIPTION
Nm
is the default configuration file for the NPF packet filter.
Pp
This manual page serves as a reference for editing
Nm .
Please refer to the official NPF documentation website for comprehensive and
in-depth information.
Pp
There are multiple structural elements that
Nm
may contain, such as:
Pp
Bl -bullet -offset indent -compact
It
variables
It
table definitions (with or without content)
It
abstraction groups
It
packet filtering rules
It
map rules for address translation
It
application level gateways
It
procedure definitions to call on filtered packets
It
parameter settings.
El
Sh SYNTAX
Ss Variables
Variables are specified using the dollar
Pq Li $
sign, which is used for both
definition and referencing of a variable.
Variables are defined by assigning a value to them as follows:
Pp
Dl $var1 = 10.0.0.1
Pp
A variable may also be defined as a set:
Bd -literal -offset indent
$var2 = {
10.0.0.1, # First host
10.0.0.2, # Second host
}
Ed
Pp
Newlines within curly braces are ignored, and trailing commas are optional.
Common variable definitions are for IP addresses, networks, ports,
and interfaces.
Ss Tables
Tables are specified using a name between angle brackets
Sq Li <
and
Sq Li > .
The following is an example of table definition:
Pp
Dl table <blocklist> type ipset
Pp
Currently, tables support three data storage types:
Cm ipset ,
Cm lpm ,
or
Cm const .
The contents of the table may be pre-loaded from the specified file.
The
Cm const
tables are immutable (no insertions or deletions after loading) and
therefore must always be loaded from a file.
Pp
The specified file should contain a list of IP addresses and/or networks
in the form of
Li 10.1.1.1
or
Li 10.0.0.0/24 .
Pp
Tables of type
Cm ipset
and
Cm const
can only contain IP addresses (without masks).
The
Cm lpm
tables can contain networks and they will perform the longest
prefix match on lookup.
Ss Interfaces
In NPF, an interface can be referenced directly by using its name, or can be
passed to an extraction function which will return a list of IP addresses
configured on the actual associated interface.
Pp
It is legal to pass an extracted list from an interface in keywords where
NPF would expect instead a direct reference to said interface.
In this case, NPF infers a direct reference to the interface, and does not
consider the list.
Pp
There are two types of IP address lists.
With a static list, NPF will capture the interface addresses on configuration
load, whereas with a dynamic list NPF will capture the runtime list of
addresses, reflecting any changes to the interface, including the attach and
detach.
Note that with a dynamic list, bringing the interface down has no effect,
all addresses will remain present.
Pp
Three functions exist, to extract addresses from an interface with a chosen
list type and IP address type:
Bl -tag -width "Fn ifaddrs interface" -offset indent
It Fn inet4 interface
Static list.
IPv4 addresses.
It Fn inet6 interface
Static list.
IPv6 addresses.
It Fn ifaddrs interface
Dynamic list.
Both IPv4 and IPv6.
The
Cm family
keyword of a filtering rule can be used in combination to explicitly select
an IP address type.
This function can also be used with
Cm map
to specify the translation address, see below.
El
Pp
Example of configuration:
Bd -literal -offset indent
$var1 = inet4(wm0)
$var2 = ifaddrs(wm0)
group default {
block in on wm0 all # rule 1
block in on $var1 all # rule 2
block in on inet4(wm0) all # rule 3
pass in on inet6(wm0) from $var2 # rule 4
pass in on wm0 from ifaddrs(wm0) # rule 5
}
Ed
Pp
In the above example,
Li $var1
is the static list of IPv4 addresses configured
on wm0, and
Li $var2
is the dynamic list of all the IPv4 and IPv6 addresses configured on wm0.
The first three rules are equivalent, because with the
Ic block Ar "..." Cm on Li < Ns Ar interface Ns Li >
syntax, NPF expects a direct reference to an interface, and therefore does
not consider the extraction functions.
The fourth and fifth rules are equivalent, for the same reason.
Ss Groups
NPF requires that all rules be defined within groups.
Groups can be thought of as higher level rules which can contain subrules.
Groups may have the following options: name, interface, and direction.
Packets matching group criteria are passed to the ruleset of that group.
If a packet does not match any group, it is passed to the
Dv default
group.
The
Dv default
group must always be defined.
Pp
Example of configuration:
Bd -literal -offset indent
group "my-name" in on wm0 {
# List of rules, for packets received on wm0
}
group default {
# List of rules, for the other packets
}
Ed
Ss Rules
With a rule statement NPF is instructed to
Ic pass
or
Ic block
a packet depending on packet header information, transit direction and
the interface it arrived on, either immediately upon match or using the
last match.
Pp
If a packet matches a rule which has the
Cm final
option set, this rule is considered the last matching rule, and
evaluation of subsequent rules is skipped.
Otherwise, the last matching rule is used.
Pp
The
Cm proto
keyword can be used to filter packets by layer 4 protocol (TCP, UDP, ICMP
or other).
Its parameter should be a protocol number or its symbolic name,
as specified in the
Pa /etc/protocols
file.
This keyword can additionally have protocol-specific options, such as
Cm flags .
Pp
The
Cd flags
keyword can be used to match the packets against specific TCP flags,
according to the following syntax:
Pp
D1 Ic proto Cm tcp flags Ar match Ns Op Li / Ns Ar mask
Pp
Where
Ar match
is the set of TCP flags to be matched, out of the
Ar mask
set, both sets being represented as a string combination of:
Sq Cm S
(SYN),
Sq Cm A
(ACK),
Sq Cm F
(FIN), and
Sq Cm R
(RST).
The flags that are not present in
Ar mask
are ignored.
Pp
To notify the sender of a blocking decision, three
Cm return
options can be used in conjunction with a
Ic block
rule:
Bl -tag -width "Cm return-icmp" -offset indent
It Cm return
Behaves as
Cm return-rst
or
Cm return-icmp ,
depending on whether the packet being blocked is TCP or UDP.
It Cm return-rst
Return a TCP RST message, when the packet being blocked is a TCP packet.
Applies to IPv4 and IPv6.
It Cm return-icmp
Return an ICMP UNREACHABLE message, when the packet being blocked is a UDP packet.
Applies to IPv4 and IPv6.
El
Pp
The
Cm from
and
Cm to
keywords are provided to filter by source or destination IP addresses.
They can be used in conjunction with the
Cm port
keyword.
Negation (the exclamation mark) can be used in front of the address
filter criteria.
Pp
Further packet specification at present is limited to TCP and UDP
understanding source and destination ports, and ICMP and IPv6-ICMP
understanding icmp-type.
Pp
A rule can also instruct NPF to create an entry in the state table when
passing the packet or to apply a procedure to the packet (e.g. "log").
Pp
A
Dq fully-featured
rule would for example be:
Bd -literal -offset indent
pass stateful in final family inet4 proto tcp flags S/SA \e
from $source port $sport to $dest port $dport \e
apply \*qsomeproc\*q
Ed
Pp
Alternatively, NPF supports
Xr pcap-filter 7
syntax, for example:
Pp
Dl block out final pcap-filter \*qtcp and dst 10.1.1.252\*q
Pp
Fragments are not selectable since NPF always reassembles packets
before further processing.
Ss Layer 2 filtering
Pp
NPF allows the filtering of frames at the data link layer.
NPF also requires that the inspection rules are defined within groups.
Groups containing rules to filter frames should be marked with a
Cm layer-2
label.
If layer 2 groups are defined in your NPF configuration, then a
Cm layer-2
Dv default
group becomes mandatory.
Pp
Example of configuration:
Bd -literal -offset indent
group "my-name" in on wm0 layer-2 {
# List of rules, for frames received on wm0
}
group default layer-2 {
# List of rules, for the other frames
}
Ed
Pp
Rules for filtering at the data link layer are configured based on
the interface name, direction, source and destination MAC addresses, and EtherType.
Rules that are defined for the link layer should pass the
Cm ether
keyword after the pass or block instruction.
EtherType is passed on the rule by preceeding the four digit hexadecimal constant
EtherType with "Ex".
When a frame matches a rule with the
Cm final
keyword, the rule is considered the last matching rule.
Pp
A
Dq fully-featured
rule would for example be:
Bd -literal -offset indent
pass ether in final from $src_mac to $dest_mac type $ether_type
Ed
Pp
Example of rule configuration:
Bd -literal -offset indent
pass ether from 00:00:5E:00:53:00 to 00:00:5E:00:53:01 type Ex0800
Ed
Pp
This passes frames with source MAC address 00:00:5E:00:53:00 and
destination MAC address 00:00:5E:00:53:01 carrying IP packets(0800).
Alternatively, layer 2 rules also support variables.
Pp
Dl block ether in final from $source_mac to $dest_mac type $ether_type
Pp
Filtering at this layer is stateless and has no access to upper layer protocols.
Block returns are not supported.
MAC address tables are also not supported yet.
Ss User/group ID filtering
Pp
NPF allows filtering by user or group identity.
Packet filtering by user or group
controls data packet flows based on the user or group identity of the process
that generated the traffic, or is waiting to receive traffic,
rather than just traditional parameters like IP address, port number, and protocol.
Pp
There are many situations where this is useful:
Bl -bullet -hang
It Finer-grained access control
One can allow specific destinations to be accessed only by certain users
or groups.
It Application level security
Two processes are using a specific port, but only one should be allowed to
access packets originating from a particular host.
It Improves isolation in multi-tenant systems
Prevent an untrusted user from making any network connections.
It Security hardening and containment
A user application that has been exploited can be prevented from making
network connections to a command-and-control server.
It Compliance and policy enforcement
Can restrict access to particular networks to network administrators only.
El
This filtering process can be achieved by passing the user or group ID on the rule.
Pp
Dl pass out from all user jack group < 1000
Pp
The above rule only allows sockets of processes owned by user jack
and belonging to a group with an ID value of less than 1000.
Pp
Dl block in from all user > 100 group wheel
Pp
The above rule prevents all listening sockets bound by processes owned by any user
with the ID value greater than 100 and belonging to the wheel group.
Pp
A rule can have either a user ID or group ID set.
If both are set, both must
agree to be a match to the socket involved in communication.
Numbers or names can be used for the identification of the user or group as they
still resolve to a numeric ID of the user or group.
Ss Stateful
NPF supports stateful packet inspection which can be used to bypass
unnecessary rule processing as well as to complement NAT.
The connection state is uniquely identified by an n-tuple: IP version,
layer 4 protocol, source and destination IP addresses and port numbers.
Each state is represented by two keys: one for the original flow and
one for the reverse flow, so that the reverse lookup on the returning
packets would succeed.
The packets are matched against the connection direction respectively.
Pp
Depending on the settings (see the section on
Li state.key
in the
Xr npf-params 7
manual), the connection identifier (keys) may also include the interface ID,
making the states per-interface.
Pp
Stateful packet inspection is enabled using the
Cm stateful
or
Cm stateful-all
keywords.
The former matches the interface after the state lookup, while the latter
avoids matching the interface (assuming the
Li state.key.interface
parameter is disabled),
i.e. making the state global, and must be used with caution.
In both cases, a full TCP state tracking is performed for TCP connections
and a limited tracking for message-based protocols (UDP and ICMP).
Pp
By default, a stateful rule implies SYN-only flag check
Pq Dq Li flags S/SAFR
for the TCP packets.
It is not advisable to change this behavior; however,
it can be overridden with the aforementioned
Cm flags
keyword.
Ss Map
Network Address Translation (NAT) is expressed in a form of segment mapping.
The translation may be
Cm dynamic
(stateful) or
Cm static
(stateless).
The following mapping types are available:
Pp
Bl -tag -width "Cm \&<->" -offset indent -compact
It Cm \&->
outbound NAT (translation of the source)
It Cm \&<-
inbound NAT (translation of the destination)
It Cm \&<->
bi-directional NAT (combination of inbound and outbound NAT)
El
Pp
The following would translate the source (10.1.1.0/24) to the IP address
specified by
Li $pub_ip
for the packets on the interface
Li $ext_if .
Pp
Dl map $ext_if dynamic 10.1.1.0/24 -> $pub_ip
Pp
Translations are implicitly filtered by limiting the operation to the
network segments specified, that is, translation would be performed only
on packets originating from the 10.1.1.0/24 network.
Explicit filter criteria can be specified using
Cm pass Ar criteria ...
as an additional option of the mapping.
Pp
The dynamic NAT implies network address and port translation (NAPT).
The port translation can be controlled explicitly.
For example, the following provides
Dq port forwarding ,
redirecting the public port 9022 to the port 22 of an internal host:
Pp
Dl map $ext_if dynamic proto tcp 10.1.1.2 port 22 <- $ext_if port 9022
Pp
In the regular dynamic NAT case, it is also possible to disable port
translation using the
Cm no-ports
flag.
Pp
The translation address can also be dynamic, based on the interface.
The following would select the IPv4 address(es) currently assigned to the
interface:
Pp
Dl map $ext_if dynamic 10.1.1.0/24 -> ifaddrs($ext_if)
Pp
If the dynamic NAT is configured with multiple translation addresses,
then a custom selection algorithm can be chosen using the
Cm algo
keyword.
The currently available algorithms for the dynamic translation are:
Bl -tag -width "Cm round-robin" -offset indent
It Cm ip-hash
The translation address for a new connection is selected based on a
hash of the original source and destination addresses.
This algorithms attempts to keep all connections of particular client
associated with the same translation address.
This is the default algorithm.
It Cm round-robin
The translation address for each new connection is selected on a
round-robin basis.
It Cm netmap
See the description below.
El
Pp
The static NAT can also have different address translation algorithms,
chosen using the
Cm algo
keyword.
The currently available algorithms are:
Bl -tag -width "Cm netmap" -offset indent
It Cm netmap
Network address mapping from one segment to another, leaving the host
part as-is.
The new address is computed as following:
Pp
Dl addr = net-addr | (orig-addr & ~mask)
It Cm npt66
IPv6-to-IPv6 network prefix translation (NPTv6).
El
Pp
If no algorithm is specified, then 1:1 address mapping is assumed.
Currently, the static NAT algorithms do not perform port translation.
Ss Application Level Gateways
Certain application layer protocols are not compatible with NAT and require
translation outside layers 3 and 4.
Such translation is performed by packet filter extensions called
Application Level Gateways (ALGs).
Pp
NPF supports the following ALGs:
Bl -tag -width "Cm icmp" -offset indent
It Cm icmp
ICMP ALG.
Applies to IPv4 and IPv6.
Allows to find an active connection by looking at the ICMP payload, and to
perform NAT translation of the ICMP payload.
Generally, this ALG is necessary to support
Xr traceroute 8
behind the NAT, when using the UDP or TCP probes.
El
Pp
The ALGs are built-in.
If NPF is used as kernel module, then they come as kernel modules too.
In such case, the ALG kernel modules can be autoloaded through the
configuration, using the
Cm alg
keyword.
Pp
For example:
Pp
Dl alg \*qicmp\*q
Pp
Alternatively, the ALG kernel modules can be loaded manually, using
Xr modload 8 .
Ss Procedures
A rule procedure is defined as a collection of extension calls (it
may have none).
Every extension call has a name and a list of options in the form of
key-value pairs.
Depending on the call, the key might represent the argument and the value
might be optional.
Available options:
Bl -tag -width "Cm log: Ar interface" -offset indent
It Cm log : Ar interface
Log events.
This requires the
Pa npf_ext_log
kernel module, which would normally get
auto-loaded by NPF.
The specified npflog interface would also be auto-created once the
configuration is loaded.
The log packets can be written to a file using the
Xr npfd 8
daemon.
It Cm normalize : Ar option1 Ns Op Li \&, Ar option2 ...
Modify packets according to the specified normalization options.
This requires the
Pa npf_ext_normalize kernel
module, which would normally get auto-loaded by NPF.
El
Pp
The available normalization options are:
Bl -tag -width "Cm \*qmin-mss\*q Ar value" -offset indent
It Cm \*qmax-mss\*q Ar value
Enforce a maximum value for the Maximum Segment Size (MSS) TCP option.
Typically, for
Dq MSS clamping .
It Cm \*qmin-ttl\*q Ar value
Enforce a minimum value for the IPv4 Time To Live (TTL) parameter.
It Cm \*qno-df\*q
Remove the Don't Fragment (DF) flag from IPv4 packets.
It Cm \*qrandom-id\*q
Randomize the IPv4 ID parameter.
El
Pp
For example:
Bd -literal -offset indent
procedure "someproc" {
log: npflog0
normalize: "random-id", "min-ttl" 64, "max-mss" 1432
}
Ed
Pp
In this case, the procedure calls the logging and normalization modules.
Ss Parameter settings
NPF supports a set of dynamically tunable configuration-wide parameters.
For example:
Bd -literal -offset indent
set state.tcp.timeout.time_wait 0 # destroy the state immediately
Ed
Pp
See
Xr npf-params 7
for the list of parameters and their details.
Ss Misc
Text after a hash
Pq Sq #
character is considered a comment.
The backslash
Pq Sq \e
character at the end of a line marks a continuation line,
i.e., the next line is considered an extension of the present line.
Additionally, within curly braces of variable definitions, newlines are
allowed without continuation characters.
Sh GRAMMAR
The following is a non-formal BNF-like definition of the grammar.
The definition is simplified and is intended to be human readable,
therefore it does not strictly represent the formal grammar.
Bd -literal
# Syntax of a single line. Lines can be separated by LF (\\n) or
# a semicolon. Comments start with a hash (#) character.
syntax = var-def | set-param | alg | table-def |
map | group | proc | comment
# Variable definition. Names can be alpha-numeric, including "_"
# character.
var-name = "$" . string
interface = interface-name | var-name
var-def = var "=" ( var-value | "{" value *[ "," value ] [ "," ] "}" )
# Parameter setting.
set-param = "set" param-value
# Application level gateway. The name should be in double quotes.
alg = "alg" alg-name
alg-name = "icmp"
# Table definition. Table ID shall be numeric. Path is in the
# double quotes.
table-id = <table-name>
table-def = "table" table-id "type" ( "ipset" | "lpm" | "const" )
[ "file" path ]
# Mapping for address translation.
map = map-common | map-ruleset
map-common = "map" interface
( "static" [ "algo" map-algo ] | "dynamic" )
[ map-flags ] [ proto ]
map-seg ( "->" | "<-" | "<->" ) map-seg
[ "pass" [ proto ] filt-opts ]
map-ruleset = "map" "ruleset" group-opts
map-algo = "ip-hash" | "round-robin" | "netmap" | "npt66"
map-flags = "no-ports"
map-seg = ( addr-mask | interface ) [ port-opts ]
# Rule procedure definition. The name should be in the double quotes.
#
# Each call can have its own options in a form of key-value pairs.
# Both key and values may be strings (either in double quotes or not)
# and numbers, depending on the extension.
proc = "procedure" proc-name "{" *( proc-call [ new-line ] ) "}"
proc-opts = key [ " " val ] [ "," proc-opts ]
proc-call = call-name ":" proc-opts new-line
# Group definition and the rule list.
group = "group" ( "default" | group-opts ) "{" rule-list "}"
group-opts = name-string [ "in" | "out" ] [ "on" interface ]
rule-list = [ rule new-line ] rule-list
npf-filter = [ "family" family-opt ] [ proto ] ( "all" | filt-opts )
static-rule = ( "block" [ block-opts ] | "pass" )
[ "stateful" | "stateful-all" ]
[ "in" | "out" ] [ "final" ] [ "on" interface ]
( npf-filter | "pcap-filter" pcap-filter-expr )
[ "apply" proc-name ]
dynamic-ruleset = "ruleset" group-opts
rule = static-rule | dynamic-ruleset
tcp-flag-mask = tcp-flags
tcp-flags = [ "S" ] [ "A" ] [ "F" ] [ "R" ]
block-opts = "return-rst" | "return-icmp" | "return"
family-opt = "inet4" | "inet6"
proto-opts = "flags" tcp-flags [ "/" tcp-flag-mask ] |
"icmp-type" type [ "code" icmp-code ]
proto = "proto" protocol [ proto-opts ]
filt-opts = "from" filt-addr [ port-opts ] "to" filt-addr [ port-opts ] user_id group_id
filt-addr = [ "!" ] [ interface | addr-mask | table-id | "any" ]
port-opts = "port" ( port-num | port-from "-" port-to | var-name )
addr-mask = addr [ "/" mask ]
user_id = "user" id_items
group_id = "group" id_items
id_items = [id] | [op_unary id] | [id op_binary id]
op_unary = ["="] | ["!="] | ["<="] | [">="] | [">"] | ["<"]
op_binary = ["<>"] | ["><"]
Ed
\" -----
Sh FILES
Bl -tag -width Pa -compact
It Pa /dev/npf
control device
It Pa /etc/npf.conf
default configuration file
It Pa /usr/share/examples/npf
directory containing further examples
El
\" -----
Sh EXAMPLES
Bd -literal
$ext_if = { inet4(wm0) }
$int_if = { inet4(wm1) }
table <blocklist> type ipset file "/etc/npf_blocklist"
table <limited> type lpm
$services_tcp = {
http, # Web traffic
https, # Secure web traffic
smtp, # Email sending
domain, # DNS queries
6000, # Custom service
9022, # SSH forwarding
}
$services_udp = { domain, ntp, 6000, }
$localnet = { 10.1.1.0/24 }
alg "icmp"
# These NAT rules will dynamically select the interface address(es).
map $ext_if dynamic 10.1.1.0/24 -> ifaddrs($ext_if)
map $ext_if dynamic proto tcp 10.1.1.2 port 22 <- ifaddrs($ext_if) port 9022
procedure "log" {
# The logging facility can be used together with npfd(8).
log: npflog0
}
group "external" on $ext_if {
pass stateful out final all
block in final from <blocklist>
pass stateful in final family inet4 proto tcp to $ext_if \e
port ssh apply "log"
pass stateful in final proto tcp to $ext_if \e
port $services_tcp
pass stateful in final proto udp to $ext_if \e
port $services_udp
pass stateful in final proto tcp to $ext_if \e
port 49151-65535 # passive FTP
pass stateful in final proto udp to $ext_if \e
port 33434-33600 # traceroute
}
group "internal" on $int_if {
block in all
block in final from <limited>
# Ingress filtering as per BCP 38 / RFC 2827.
pass in final from $localnet
pass out final all
}
group default {
pass final on lo0 all
block all
}
Ed
\" -----
Sh SEE ALSO
Xr bpf 4 ,
Xr npf 7 ,
Xr npf-params 7 ,
Xr pcap-filter 7 ,
Xr npfctl 8 ,
Xr npfd 8
Pp
Lk
http://rmind.github.io/npf/ "NPF documentation website"
Sh HISTORY
NPF first appeared in
Nx 6.0 .
Sh AUTHORS
NPF was designed and implemented by
An Mindaugas Rasiukevicius .
