systemd-networkd - predictable configuration for servers

systemd-networkd is the network manager that ships with systemd itself. Compared to NetworkManager, it is simpler, more predictable, and has no concept of “profiles competing for an interface”.

It ships everywhere systemd does. It is the default in far fewer places:

• Ubuntu Server: yes, as the renderer Netplan drives.
• Arch: yes.
• Debian: no. The installer configures ifupdown (/etc/network/interfaces) on a server install, and NetworkManager when you select a desktop. networkd is an opt-in migration.
• RHEL 9, Rocky, Alma, Fedora: no, and not merely by default — NetworkManager is the only supported network manager on RHEL. networkd is present because systemd ships it, not because it is a supported configuration. Deploying it there puts you outside the support boundary and outside every tool your colleagues reach for.

When to choose systemd-networkd

systemd-networkd is the right choice when:

• The host is a headless server.
• The configuration is stable - few changes after install.
• You want declarative .network files in /etc/systemd/network/.
• You do not need Wi-Fi, mobile broadband, or VPN.

For laptops and desktops, NetworkManager is better.

Configuration files

All .network files from /etc/systemd/network/, /run/systemd/network/ and /usr/lib/systemd/network/ are sorted together in alphanumeric order, regardless of which directory they came from. The first file whose [Match] section matches an interface is applied, and every later matching file is ignored — even if it also matches.

There is no merging and no override between separate .network files. This is the single most common misconception about networkd, and it is the opposite of how sysctl.d or /etc/profile.d behave.

So to change a setting on an interface you have two correct options:

• Edit the file that already wins.
• Add a drop-in: .conf files under /etc/systemd/network/10-eth0.network.d/ are merged, and are parsed after the main file, so they can alter or add settings without touching it.

Files with identical names shadow each other by directory priority: /etc/ beats /run/, which beats /usr/lib/. That is how you override a distribution-supplied file — same filename, in /etc/.

The convention is to name files with a two-digit prefix (e.g. 10-eth0.network) and to keep the number below 70, so distribution defaults and generated files do not sort ahead of yours.

Always confirm which file actually won:

networkctl status eth0
networkctl list

A static configuration

# /etc/systemd/network/10-eth0.network
[Match]
Name=eth0

[Network]
Address=10.0.0.10/24
Address=2001:db8:85a3:1::10/64
Gateway=10.0.0.1
IPv6AcceptRA=true
DNS=1.1.1.1
DNS=8.8.8.8
Domains=example.com

The [Match] section selects which interface the file applies to. Name=eth0 is the most common; MACAddress= and Driver= are also available.

Enable and apply

sudo systemctl enable --now systemd-networkd
sudo systemctl restart systemd-networkd
networkctl reload
networkctl status
networkctl list

networkctl list shows every interface and its config file. networkctl status eth0 shows the resolved configuration.

DHCP

[Match]
Name=eth0

[Network]
DHCP=ipv4
IPv6AcceptRA=true

DHCP=ipv4 runs a built-in DHCP client. DHCP=ipv6 uses DHCPv6; DHCP=yes is shorthand for both.

VLANs, bridges, and bonds

Virtual devices are configured in .netdev files:

# /etc/systemd/network/20-vlan100.netdev
[NetDev]
Name=vlan100
Kind=vlan

[VLAN]
Id=100

And referenced from a .network file:

[Match]
Name=eth0

[Network]
VLAN=vlan100

DHCP server and forwarding

systemd-networkd can act as a DHCP server and a router:

[Network]
DHCPServer=yes

[DHCPServer]
PoolOffset=100
PoolSize=50
DNS=1.1.1.1

PoolOffset= is an integer offset from the base of the interface’s subnet, not an address. man 5 systemd.network: “PoolOffset= takes the offset of the pool from the start of subnet”. On a 10.0.0.0/24 interface, PoolOffset=100 with PoolSize=50 hands out 10.0.0.100–10.0.0.149.

Writing an address there is a parse error, and networkd’s failure mode is quiet: the offending setting is rejected, the rest of the file still loads, and you get an interface with no DHCP server rather than a startup failure. Check that it took:

networkctl status eth0
sudo journalctl -u systemd-networkd -b | grep -i 'invalid\|ignoring'

Enable IP forwarding in /etc/sysctl.d/:

net.ipv4.ip_forward=1

For most production servers this is unnecessary; the default gateway is a dedicated router or a load balancer.

Knowledge check