diff --git a/ndn_utils/nlsr.conf b/ndn_utils/nlsr.conf
new file mode 100644
index 0000000..89fad50
--- /dev/null
+++ b/ndn_utils/nlsr.conf
@@ -0,0 +1,147 @@
+; the general section contains all the general settings for router
+
+$GENERAL_SECTION
+
+; the neighbors section contains the configuration for router's neighbors and hello's behavior
+
+$NEIGHBORS_SECTION
+
+; the hyperbolic section contains the configuration settings of enabling a router to calculate
+; routing table using [hyperbolic routing table calculation](http://arxiv.org/abs/0805.1266) method
+
+$HYPERBOLIC_SECTION
+
+
+; the fib section is used to configure fib entry's type to ndn FIB updated by NLSR
+
+$FIB_SECTION
+
+; the advertising section contains the configuration settings of the name prefixes
+; hosted by this router
+
+$ADVERTISING_SECTION
+
+security
+{
+  validator
+  {
+    rule
+    {
+      id "NSLR Hello Rule"
+      for data
+      filter
+      {
+        type name
+        regex ^[^<NLSR><INFO>]*<NLSR><INFO><><>$
+      }
+      checker
+      {
+        type customized
+        sig-type rsa-sha256
+        key-locator
+        {
+          type name
+          hyper-relation
+          {
+            k-regex ^([^<KEY><NLSR>]*)<NLSR><KEY><ksk-.*><ID-CERT>$
+            k-expand \\1
+            h-relation equal
+            p-regex ^([^<NLSR><INFO>]*)<NLSR><INFO><><>$
+            p-expand \\1
+          }
+        }
+      }
+    }
+
+    rule
+    {
+      id "NSLR LSA Rule"
+      for data
+      filter
+      {
+        type name
+        regex ^[^<NLSR><LSA>]*<NLSR><LSA>
+      }
+      checker
+      {
+        type customized
+        sig-type rsa-sha256
+        key-locator
+        {
+          type name
+          hyper-relation
+          {
+            k-regex ^([^<KEY><NLSR>]*)<NLSR><KEY><ksk-.*><ID-CERT>$
+            k-expand \\1
+            h-relation equal
+            p-regex ^([^<NLSR><LSA>]*)<NLSR><LSA>(<>*)<><><>$
+            p-expand \\1\\2
+          }
+        }
+      }
+    }
+
+    rule
+    {
+      id "NSLR Hierarchy Exception Rule"
+      for data
+      filter
+      {
+        type name
+        regex ^[^<KEY><%C1.Router>]*<%C1.Router>[^<KEY><NLSR>]*<KEY><ksk-.*><ID-CERT><>$
+      }
+      checker
+      {
+        type customized
+        sig-type rsa-sha256
+        key-locator
+        {
+          type name
+          hyper-relation
+          {
+	    k-regex ^([^<KEY><%C1.Operator>]*)<%C1.Operator>[^<KEY>]*<KEY><ksk-.*><ID-CERT>$
+            k-expand \\1
+            h-relation equal
+            p-regex ^([^<KEY><%C1.Router>]*)<%C1.Router>[^<KEY>]*<KEY><ksk-.*><ID-CERT><>$
+            p-expand \\1
+          }
+        }
+      }
+    }
+
+    rule
+    {
+      id "NSLR Hierarchical Rule"
+      for data
+      filter
+      {
+        type name
+        regex ^[^<KEY>]*<KEY><ksk-.*><ID-CERT><>$
+      }
+      checker
+      {
+        type hierarchical
+        sig-type rsa-sha256
+      }
+    }
+
+    trust-anchor
+    {
+      type any
+      file-name "root.cert"
+    }
+  }
+  ; cert-to-publish "root.cert"  ; optional, a file containing the root certificate
+                                 ; Only the router that is designated to publish the root cert
+                                 ; needs to specify this
+
+  ; cert-to-publish "site.cert"  ; optional, a file containing the site certificate
+                                 ; Only the router that is designated to publish the site cert
+                                 ; needs to specify this
+
+  ; cert-to-publish "operator.cert" ; optional, a file containing the operator certificate
+                                    ; Only the router that is designated to publish the operator
+                                    ; cert needs to specify this
+
+  ; cert-to-publish "router.cert"  ; required, a file containing the router certificate.
+}