The Linux kernel loads much of its functionality as modules: drivers, filesystems, network features (WireGuard, bridges, netfilter), and more. They’re loaded on demand. On a KVM VPS, you have your own kernel, so you can load the modules you need, which isn’t possible on container-based virtualization like OpenVZ or LXC.

See what is KVM virtualization.

List loaded modules

lsmod | head
lsmod | grep -E 'wireguard|br_netfilter|overlay'

Columns: module name, size, and use count, with the modules that depend on it.

Inspect a module

modinfo wireguard
modinfo -p tcp_bbr        # parameters it accepts

Available modules for the running kernel live under /lib/modules/$(uname -r)/.

Load and unload

sudo modprobe wireguard          # load (with dependencies)
sudo modprobe -r some_module     # unload (if not in use)

modprobe resolves dependencies automatically. Avoid the lower-level insmod and rmmod unless you have a reason.

If modprobe says “Module not found”, either the module doesn’t exist for your kernel, or the kernel was updated and you haven’t rebooted yet (the running kernel’s module directory is gone). Reboot into the new kernel, and try again. See check the Linux version.

Load at boot

Put module names (one per line) into a file in /etc/modules-load.d/:

echo -e "overlay\nbr_netfilter" | sudo tee /etc/modules-load.d/k8s.conf

This is the standard prep step for Kubernetes. See install Kubernetes with kubeadm.

Module options

Set parameters in /etc/modprobe.d/:

echo "options nf_conntrack hashsize=262144" | sudo tee /etc/modprobe.d/conntrack.conf

They apply the next time the module loads (reboot, or unload and reload). Current values: /sys/module/<name>/parameters/.

Blacklist a module

Prevent a module from loading automatically:

echo "blacklist floppy" | sudo tee /etc/modprobe.d/blacklist-floppy.conf
sudo update-initramfs -u        # Debian/Ubuntu (dracut -f on RHEL)

To block loading entirely (even on request): install floppy /bin/false.

Hardening guides often blacklist unused filesystem and network protocol modules (cramfs, udf, dccp, sctp) to reduce the attack surface. See Linux server hardening checklist.

Common VPS cases

Need Module(s)
WireGuard VPN wireguard (in the kernel since 5.6). See WireGuard VPN server
Docker / Kubernetes networking overlay, br_netfilter
TCP BBR congestion control tcp_bbr. See TCP BBR
Netfilter features nf_conntrack, nf_tables, xt_*
Network bonding / VLANs bonding, 8021q

DKMS: modules built outside the kernel

Third-party modules (for example some VPN or GPU drivers) are built against each kernel version. DKMS rebuilds them automatically on kernel updates:

sudo apt install dkms
dkms status

If a DKMS module fails to build after an update, the feature stops working after the reboot. Check dkms status after kernel upgrades.

Kernel messages

sudo dmesg | tail -30
journalctl -k -b | grep -i module

These show load errors, and messages from drivers. See journalctl.

Modules and Secure Boot

On systems with UEFI Secure Boot enabled, the kernel only loads modules signed with a trusted key. Out-of-tree modules built by DKMS then need to be signed with a machine owner key (MOK), or they’re refused with a “Required key not available” error. Most VPS environments boot without Secure Boot, so this mainly matters on dedicated hardware and desktops.

Quick reference

Task Command
List loaded lsmod
Info / parameters modinfo <mod>
Load / unload modprobe <mod> / modprobe -r <mod>
Load at boot /etc/modules-load.d/*.conf
Options /etc/modprobe.d/*.conf
Blacklist blacklist <mod> + rebuild initramfs

Related: Linux device files and Linux boot process.

  • Linux
  • Kernel
  • Administration