s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

nmcli

Set up, change and check network connections with NetworkManager.

Level
RHCSA exam
Group
Network
Needs root
For changes
Package
NetworkManager

What it does

NetworkManager is the service that runs the network on Red Hat Enterprise Linux. It keeps your settings in connection profiles. A profile holds the IP addresses, the gateway, DNS servers and more. nmcli is the command-line tool to read and change these profiles and the devices (network cards).

Settings you make with nmcli are saved in the profile, so they stay after a reboot. This is the big difference with the ip command, whose changes are lost at reboot.

Most commands can be shortened: nmcli connection show = nmcli con show = nmcli c s. Tab completion helps you find the next word.

How to write it

nmcli [OPTIONS] OBJECT { COMMAND | help }
nmcli connection { show | up | down | modify | add | edit | clone | delete | reload | load | import | export | monitor }
nmcli device { status | show | set | connect | disconnect | reapply | modify | delete | monitor | wifi | lldp }
nmcli general { status | hostname | permissions | logging | reload }
nmcli networking { on | off | connectivity }
nmcli radio { all | wifi | wwan } [ on | off ]

Main parts

general
Overall status of NetworkManager, the hostname, your permissions and the log level.
networking
Turn all networking on or off, or check the internet connectivity.
radio
Turn Wi-Fi and mobile broadband radios on or off.
connection (con, c)
Work with profiles: show, add, modify, up, down, delete, reload.
device (dev, d)
Work with network cards: status, details, connect, disconnect, Wi-Fi.
monitor
Watch changes of devices and connections live.
agent
Run as a secret or polkit agent (asks for passwords).

Options 45

Most used

Global options (before the object)

-t, --terse
Short output for scripts. No headers, fields split by ":".
-f, --fields list
Choose which columns to show, for example NAME,DEVICE. all and common also work.
-g, --get-values list
Print only the values of these fields. Same as -t -f together. Good for scripts.
-p, --pretty
Easy-to-read output with headers and lines between groups.
-m, --mode {tabular|multiline}
Show the output as a table or as one field per line.
-c, --colors {yes|no|auto}
Use colors in the output, or not.
-e, --escape {yes|no}
Escape ":" and "\" in terse output (yes is the default).
-a, --ask
Ask for missing values, like a Wi-Fi password.
-s, --show-secrets
Show passwords and keys in the output.
-w, --wait seconds
How long to wait for an action to finish (for example con up).
--offline
Work on profile files without a running NetworkManager (with connection add/modify, reading and writing keyfiles on stdin and stdout).
--complete-args
Print the possible next words (used by tab completion).
-h, --help
Show help. Also works after any object: nmcli con help.
-v, --version
Show the nmcli version.

Options of connection commands

--active
With con show: list only the active profiles.
--order list
With con show: sort the list, for example --order +type,-name.
--temporary
With con modify: change only the running state, not the saved profile.
save {yes|no}
With con add: save no makes a profile that is not written to disk.
con-name name
With con add: the name of the new profile.
ifname device
With con add: the device the profile belongs to. Use * for any device.
type type
With con add: the kind of profile: ethernet, wifi, bond, bridge, vlan, team, vpn, loopback …

Settings you change often (setting.property)

ipv4.method {auto|manual|disabled|link-local|shared}
auto = DHCP, manual = fixed address, disabled = no IPv4.
ipv4.addresses ip/prefix
The fixed IPv4 address(es) with prefix, like 192.168.122.10/24. Use + or - to add or remove one.
ipv4.gateway ip
The default gateway for IPv4.
ipv4.dns list
The DNS servers, separated by space or comma.
ipv4.ignore-auto-dns {yes|no}
Do not use the DNS servers that DHCP sends.
ipv4.ignore-auto-routes {yes|no}
Do not use routes that DHCP sends.
ipv4.routes list
Extra routes: "10.20.0.0/16 192.168.122.254". Use + to add.
ipv4.route-metric n
Priority of the routes of this profile. Lower wins.
ipv4.never-default {yes|no}
Never use this profile for the default route.
ipv4.may-fail {yes|no}
With "no", the profile is only up when IPv4 works.
ipv6.method {auto|manual|ignore|disabled|link-local|dhcp|shared}
How IPv6 gets its address. disabled = no IPv6 on this profile.
ipv6.addresses ip/prefix
The fixed IPv6 address(es), like 2001:db8:10::10/64.
ipv6.gateway ip
The default gateway for IPv6.
ipv6.dns list
IPv6 DNS servers.
connection.id name
The profile name. Change it to rename a profile.
connection.autoconnect {yes|no}
Start this profile by itself (also at boot).
connection.autoconnect-priority n
When several profiles can start, the highest number wins.
connection.interface-name device
Bind the profile to one device.
connection.zone zone
The firewalld zone for this profile, like internal or public.
802-3-ethernet.mtu bytes
The MTU of the card (short name: ethernet.mtu).
802-3-ethernet.cloned-mac-address mac
Use another MAC address (or random, stable).
vlan.id n
With type vlan: the VLAN number.
bond.options list
With type bond: like "mode=active-backup,miimon=100".

Examples 16

$ run as a normal user# run as root (or with sudo)

  1. 1Show all profiles and which device uses them

    nmcli connection show
NAME    UUID                                  TYPE      DEVICE
enp1s0  3f0c3a8e-6c35-4c5a-9a0e-7f1a2b3c4d5e  ethernet  enp1s0
lo      2b1c5e3a-1d2e-4f5a-8b9c-0d1e2f3a4b5c  loopback  lo

    A profile with an empty DEVICE column is not active now.

  2. 2Show the state of every network card

    nmcli device status
DEVICE  TYPE      STATE                   CONNECTION
enp1s0  ethernet  connected               enp1s0
lo      loopback  connected (externally)  lo

    "disconnected" means the card works but no profile is active on it. "unmanaged" means NetworkManager does not control it.

  3. 3Give a server a fixed IPv4 address

    nmcli con mod enp1s0 ipv4.method manual ipv4.addresses 192.168.122.10/24 \
    ipv4.gateway 192.168.122.1 ipv4.dns 192.168.122.1
nmcli con up enp1s0

    The change is saved in the profile. con up uses it right now.

  4. 4Add a second address without removing the first

    nmcli con mod enp1s0 +ipv4.addresses 192.168.122.110/24
nmcli con up enp1s0

    Use a minus to remove one address again: -ipv4.addresses 192.168.122.110/24.

  5. 5Create a new profile with a fixed address

    nmcli con add con-name app-net type ethernet ifname enp2s0 \
    ipv4.method manual ipv4.addresses 10.10.20.15/24 ipv4.gateway 10.10.20.1 ipv4.dns 10.10.20.53

    Good for a second network card, for example a separate network for backups or databases.

  6. 6Use only your own DNS servers (ignore DHCP)

    nmcli con mod enp1s0 ipv4.dns "10.0.0.53 10.0.1.53" ipv4.ignore-auto-dns yes ipv4.dns-search corp.example.com
nmcli con up enp1s0
cat /etc/resolv.conf

    NetworkManager writes /etc/resolv.conf for you. A hardened server should use only the internal resolvers that log queries.

  7. 7Add a fixed route to another network

    nmcli con mod enp1s0 +ipv4.routes "10.20.0.0/16 192.168.122.254"
nmcli con up enp1s0
ip route show 10.20.0.0/16

    Typical for a management network or a VPN gateway. The route stays after a reboot, unlike ip route add.

  8. 8Get one value for a script

    nmcli -g IP4.ADDRESS device show enp1s0
192.168.122.10/24
nmcli -t -f NAME,DEVICE con show --active
enp1s0:enp1s0

    -g and -t give clean output without headers. Use it in provisioning scripts and health checks.

  9. 9Make a VLAN interface for a separate network

    nmcli con add type vlan con-name vlan30 dev enp1s0 id 30 \
    ipv4.method manual ipv4.addresses 172.16.30.5/24
nmcli con up vlan30

    VLANs keep traffic apart, for example a DMZ for public servers. The switch port must allow VLAN 30.

  10. 10Make a bond of two cards for failover

    nmcli con add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup,miimon=100" \
    ipv4.method manual ipv4.addresses 192.168.50.10/24 ipv4.gateway 192.168.50.1
nmcli con add type ethernet port-type bond controller bond0 con-name bond0-p1 ifname enp3s0
nmcli con add type ethernet port-type bond controller bond0 con-name bond0-p2 ifname enp4s0
nmcli con up bond0

    If one cable or switch fails, the other card takes over. Check with cat /proc/net/bonding/bond0.

  11. 11Put a profile in a firewalld zone

    nmcli con mod enp2s0 connection.zone internal
nmcli con up enp2s0
firewall-cmd --get-active-zones

    Each network card can have its own firewall rules: public for the internet side, internal for the private side.

  12. 12Turn off IPv6 on a profile

    nmcli con mod enp1s0 ipv6.method disabled
nmcli con up enp1s0

    Only do this when a policy asks for it. Many services work fine with IPv6.

  13. 13Set the hostname

    nmcli general hostname web01.example.com
hostnamectl --static
web01.example.com

    Same result as hostnamectl set-hostname.

  14. 14Check who may change the network

    nmcli general permissions

    Over SSH a normal user usually gets "no" or "auth". Use sudo.

  15. 15Read a profile edited by hand again

    vim /etc/NetworkManager/system-connections/enp1s0.nmconnection
nmcli con reload
nmcli con up enp1s0

    reload only reads the files again. up makes the new settings active.

  16. 16Watch network changes live

    nmcli monitor

    Useful while you unplug a cable or restart a switch. Press Ctrl+C to stop.

Watch out

  • nmcli con mod only changes the profile. Run nmcli con up NAME to use the change now.
  • Over SSH, a wrong address or gateway cuts your own connection. Keep a console open.
  • Without +, a setting like ipv4.addresses replaces all old values.
  • Two profiles with autoconnect on for one device: you cannot know which one starts after a reboot.
  • ipv4.method manual needs at least one address in ipv4.addresses, or the command fails.
  • Do not edit /etc/resolv.conf by hand. NetworkManager writes it again.

Files

/etc/NetworkManager/system-connections/
The profiles, one keyfile (.nmconnection) per profile. Root only (mode 600).
/etc/NetworkManager/NetworkManager.conf
Main settings of NetworkManager.
/etc/NetworkManager/conf.d/
Extra settings files, read after the main file.
/run/NetworkManager/system-connections/
Profiles that are not saved to disk (they are gone after reboot).
/etc/resolv.conf
DNS settings. Written by NetworkManager.

Tips to remember

  • Remember the order: show → modify → up → check.
  • nmcli con show NAME lists every setting of a profile. Search it with | grep ipv4.
  • Lost in the words? Press Tab twice after any word, or type nmcli con mod NAME ipv4. and Tab.
  • man nmcli-examples has many ready-to-use examples.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man nmcli

Open the man page (linux.die.net)networkmanager.dev