🥇Manage network connections in Linux using the console utility nmcli

Leverage all the features of the NetworkManager connection management tool in the Linux command line using the nmcli utility.

Utility nmcli directly accesses the API to access NetworkManager functions.

It appeared in 2010 and has become an alternative way for many to configure network interfaces and connections. Although some still use ifconfig. As nmcli is a command-line interface (CLI) tool designed for use in terminal windows and scripts, it is perfect for system administrators working without a GUI.

The syntax of nmcli commands

In general, the syntax looks like this:

$ nmcli

options are parameters that define the specifics of nmcli operation,
section defines which capabilities of the utility to use,
action allows you to specify what exactly needs to be done.

There are a total of 8 sections, each associated with a set of commands (actions):

Help provides help on nmcli commands and their usage.
General returns the status of NetworkManager and global configuration.
Networking includes commands for querying the status of the network connection and enabling/disabling connections.
Radio includes commands for querying the status of a WiFi connection and enabling/disabling connections.
Monitor includes commands for monitoring the activity of NetworkManager and observing changes in network connection statuses.
Connection includes commands for managing network interfaces, adding new connections, and removing existing ones.
Device is mainly used for changing device-related parameters (like interface names) or for connecting devices using an existing connection.
Secret registers nmcli as a 'secret agent' for NetworkManager that listens for secret messages. This section is rarely used, as nmcli operates this way by default when connecting to networks.

Simple examples

Before starting, ensure that NetworkManager is running and nmcli can communicate with it:

$ nmcli general
STATE      CONNECTIVITY  WIFI-HW  WIFI     WWAN-HW  WWAN    
connected  full          enabled  enabled  enabled  enabled

Work often begins with viewing all network connection profiles:

$ nmcli connection show
NAME                UUID                                  TYPE      DEVICE
Wired connection 1  ac3241e4-b424-35d6-aaa7-07498561688d  ethernet  enp0s3
Wired connection 2  2279d917-fa02-390c-8603-3083ec5a1d3e  ethernet  enp0s8
Wired connection 3  52d89737-de92-35ec-b082-8cf2e5ac36e6  ethernet  enp0s9

This command uses the action show for the Connection section.

On the test machine, Ubuntu 20.04 is running. In this case, we found three wired connections: enp0s3, enp0s8, and enp0s9.

Managing Connections

It's important to understand that in nmcli, the term Connection refers to an entity that contains all the information about the connection. In other words, it is the network configuration. A Connection encapsulates all information related to connections, including link layer and IP addressing information. This corresponds to layer 2 and layer 3 in the OSI network model.

When you configure a network in Linux, you typically set up connections that will eventually be tied to network devices, which in turn are network interfaces installed on the computer. When a device uses a connection, it is considered active or up. If a connection is not being used, it is inactive or down.

Adding Network Connections

The nmcli utility allows you to quickly add and configure connections. For example, to add Wired connection 2 (with enp0s8), you need to run the following command as a superuser:

$ sudo nmcli connection add type ethernet ifname enp0s8
Connection 'ethernet-enp0s8' (09d26960-25a0-440f-8b20-c684d7adc2f5) successfully added.

In the type option, we specify that this will be an Ethernet connection, and in the ifname (interface name) option, we indicate the network interface we want to use.

Here's what happens after running the command:

$ nmcli connection show
NAME                UUID                                  TYPE      DEVICE
Wired connection 1  ac3241e4-b424-35d6-aaa7-07498561688d  ethernet  enp0s3
Wired connection 2  2279d917-fa02-390c-8603-3083ec5a1d3e  ethernet  enp0s8
Wired connection 3  52d89737-de92-35ec-b082-8cf2e5ac36e6  ethernet  enp0s9
ethernet-enp0s8     09d26960-25a0-440f-8b20-c684d7adc2f5  ethernet  --

A new connection, ethernet-enp0s8, was created. It has been assigned a UUID and the connection type is Ethernet. Let's activate it using the up command:

$ nmcli connection up ethernet-enp0s8
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)

Let's check the list of active connections again:

$ nmcli connection show --active
NAME                UUID                                  TYPE      DEVICE
Wired connection 1  ac3241e4-b424-35d6-aaa7-07498561688d  ethernet  enp0s3
ethernet-enp0s8     09d26960-25a0-440f-8b20-c684d7adc2f5  ethernet  enp0s8
Wired connection 3  52d89737-de92-35ec-b082-8cf2e5ac36e6  ethernet  enp0s9

A new connection ethernet-enp0s8 has been added, it is active and uses the network interface enp0s8.

Connection Settings

The ncmli utility allows you to easily modify parameters of existing connections. For example, you may need to change from dynamic (DHCP) to a static IP address.

Let's say we need to set the IP address to 192.168.4.26. To do this, we will use two commands. The first will set the IP address directly, while the second will switch the IP address setting method to 'manual':

$ nmcli connection modify ethernet-enp0s8 ipv4.address 192.168.4.26/24
$ nmcli connection modify ethernet-enp0s8 ipv4.method manual

Don't forget to also set the subnet mask. For our test connection, this is 255.255.255.0, or /24 for CIDR.

To make the changes take effect, you need to deactivate and then reactivate the connection:

$ nmcli connection down ethernet-enp0s8
Connection 'ethernet-enp0s8' successfully deactivated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
$ nmcli connection up ethernet-enp0s8
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveC

If you need to set DHCP instead, use auto instead of manual:

$ nmcli connection modify ethernet-enp0s8 ipv4.method auto

Working with Devices

For this, we use the Device section.

Checking Device Status

$ nmcli device status
DEVICE  TYPE      STATE      CONNECTION        
enp0s3  ethernet  connected  Wired connection 1
enp0s8  ethernet  connected  ethernet-enp0s8    
enp0s9  ethernet  connected  Wired connection 3
lo      loopback  unmanaged  --

Querying Device Information

For this, we use the show action from the Device section (you must specify the device name). The utility provides quite a bit of information, often spanning multiple pages.
Let's take a look at the interface enp0s8, which is using our new connection. We will ensure it is using exactly the IP address we set earlier:

$ nmcli device show enp0s8
GENERAL.DEVICE:                         enp0s8
GENERAL.TYPE:                           ethernet
GENERAL.HWADDR:                         08:00:27:81:16:20
GENERAL.MTU:                            1500
GENERAL.STATE:                          100 (connected)
GENERAL.CONNECTION:                     ethernet-enp0s8
GENERAL.CON-PATH:                       /org/freedesktop/NetworkManager/ActiveConnection/6
WIRED-PROPERTIES.CARRIER:               on
IP4.ADDRESS[1]:                         192.168.4.26/24
IP4.GATEWAY:                            --
IP4.ROUTE[1]:                           dst = 192.168.4.0/24, nh = 0.0.0.0, mt = 103
IP6.ADDRESS[1]:                         fe80::6d70:90de:cb83:4491/64
IP6.GATEWAY:                            --
IP6.ROUTE[1]:                           dst = fe80::/64, nh = ::, mt = 103
IP6.ROUTE[2]:                           dst = ff00::/8, nh = ::, mt = 256, table=255

There is quite a lot of information. Let's highlight the main points:

Network Interface Name: enp0s8.
Connection type: wired Ethernet connection.
We see the device's MAC address.
The Maximum Transmission Unit (MTU) is specified — the maximum size of a data packet that can be sent without fragmentation.
The device currently connected.
Connection name, used by the device: ethernet-enp0s8.
The device uses the IP address, which we set earlier: 192.168.4.26/24.

Other information pertains to the default routing parameters and gateway of the connection. They depend on the specific network.

Interactive nmcli editor

nmcli also has a simple interactive editor, which may be more comfortable for someone to use. To start it, for example, for the connection ethernet-enp0s8, use the action edit:

$ nmcli connection edit ethernet-enp0s8

It also has a brief help section, which is smaller than the console version:

===| nmcli interactive connection editor |===
Editing existing '802-3-ethernet' connection: 'ethernet-enp0s8'
Type 'help' or '?' for available commands.
Type 'print' to show all the connection properties.
Type 'describe [<setting>.<prop>]' for detailed property description.
You may edit the following settings: connection, 802-3-ethernet (ethernet), 802-1x, dcb, sriov, ethtool, match, ipv4, ipv6, tc, proxy
nmcli>

If you enter the command print and press Enter, nmcli will display all the connection properties:

===============================================================================
                 Connection profile details (ethernet-enp0s8)
===============================================================================
connection.id:                          ethernet-enp0s8
connection.uuid:                        09d26960-25a0-440f-8b20-c684d7adc2f5
connection.stable-id:                   --
connection.type:                        802-3-ethernet
connection.interface-name:              enp0s8
connection.autoconnect:                 yes
connection.autoconnect-priority:        0
connection.autoconnect-retries:         -1 (default)
connection.multi-connect:               0 (default)
connection.auth-retries:                -1
connection.timestamp:                   1593967212
connection.read-only:                   no
connection.permissions:                 --
connection.zone:                        --
connection.master:                      --
connection.slave-type:                  --
connection.autoconnect-slaves:          -1 (default)
connection.secondaries:                 --

For example, to set a property for DHCP on the connection, type goto ipv4 and press Enter:

nmcli> goto ipv4
You may edit the following properties: method, dns, dns-search, 
dns-options, dns-priority, addresses, gateway, routes, route-metric, 
route-table, routing-rules, ignore-auto-routes, ignore-auto-dns, 
dhcp-client-id, dhcp-iaid, dhcp-timeout, dhcp-send-hostname, 
dhcp-hostname, dhcp-fqdn, dhcp-hostname-flags, never-default, may-fail, 
dad-timeout
nmcli ipv4>

Then type set method auto and press Enter:

nmcli ipv4> set method auto
Do you also want to clear 'ipv4.addresses'? [yes]:

If you want to clear the static IP address, press EnterOtherwise, enter no and press Enter. You can save it if you think you'll need it in the future. However, even with a saved static IP address, DHCP will be used if the method is set to auto.

Use the save command to save your changes:

nmcli ipv4> save
Connection 'ethernet-enp0s8' (09d26960-25a0-440f-8b20-c684d7adc2f5) successfully updated.
nmcli ipv4>

Enter quit to exit the nmcli Interactive Editor. If you change your mind about exiting, use the back command.

And that's not all

Open the nmcli Interactive Editor and see how many settings there are and how many properties each setting has. The Interactive Editor is a great tool, but if you want to use nmcli in one-liners or scripts, you'll need the regular command line version.

Now that you have the basics, check out the man page of nmcli to learn what else it can help you with.