NetworkManager - flexible configuration for desktops and laptops

NetworkManager is the default network manager on Fedora, RHEL, and desktop Ubuntu. It maintains connection profiles that describe how to bring up an interface: DHCP or static, Wi-Fi network and password, VPN, and so on. It can be controlled from the GUI, from nmtui, or from nmcli on the command line.

When to choose NetworkManager

NetworkManager is the right choice when:

• The host moves between networks (laptop, mobile device).
• Wi-Fi, VPN, or mobile broadband is in use.
• Multiple profiles per interface are useful (e.g. static at work, DHCP at home).
• The team prefers declarative connection profiles.

For headless servers with stable static configuration, systemd-networkd is usually simpler.

Inspect state

nmcli general status
nmcli connection show
nmcli device status
nmcli connection show "Wired connection 1"
nmcli -f all connection show "eth0"

nmcli general status shows overall NetworkManager state. nmcli device status lists every device and its current profile (if any).

Create a static connection

sudo nmcli connection add \
  type ethernet \
  con-name "eth0-static" \
  ifname eth0 \
  ipv4.method manual \
  ipv4.addresses 10.0.0.10/24 \
  ipv4.gateway 10.0.0.1 \
  ipv4.dns "1.1.1.1,8.8.8.8" \
  ipv6.method manual \
  ipv6.addresses "2001:db8:85a3:1::10/64" \
  ipv6.gateway "2001:db8:85a3:1::1" \
  ipv6.dns "2606:4700:4700::1111"

The connection profile is saved and applied immediately.

ipv6.gateway is not optional here. ipv6.method manual stops NetworkManager accepting router advertisements on this profile, and RAs are normally the only source of the IPv6 default route. Give the address without the gateway and the host answers on its own subnet but cannot originate IPv6 traffic off-link - a failure that only shows up when something tries to reach the internet. The IPv4 gateway does not cover IPv6; each family needs its own default route.

Verify both families after bringing the profile up:

ip -4 route show default
ip -6 route show default

An empty result from the second command means IPv6 egress is broken.

Modify a connection

sudo nmcli connection modify "eth0-static" \
  ipv4.addresses "10.0.0.10/24,10.0.0.11/24" \
  +ipv4.routes "10.20.0.0/16 10.0.0.5"

Note the + prefix: ipv4.routes with + adds a route instead of replacing all routes.

Bring a connection up or down

sudo nmcli connection up "eth0-static"
sudo nmcli connection down "eth0-static"
sudo nmcli connection reload
sudo nmcli device reapply eth0

reload re-reads all profile files from disk. device reapply re-applies the active profile to the live device.

Switch a connection to DHCP

sudo nmcli connection modify "eth0-static" \
  ipv4.method auto \
  ipv4.addresses "" \
  ipv4.gateway "" \
  ipv4.dns ""

Empty the fields before setting the method, otherwise the old values stick around and confuse the new DHCP lease.

TUI mode

sudo nmtui

nmtui is a text-mode UI for the same functionality. Useful on a serial console or when you do not remember the exact nmcli syntax.

Key files

Profiles in system-connections are readable only by root; they may contain pre-shared keys and Wi-Fi passwords.

Knowledge check