Master the Linux command line with this nmcli cheat sheet focused on common networking tasks. You can manage connections, interfaces, and routing without opening graphical tools or wading through long manual pages.
Use the quick reference table below to compare core behaviors and decide which nmcli command fits your workflow.
| Command Pattern | Purpose | Typical Use Case | Key Flags |
|---|---|---|---|
| nmcli connection show | List saved connections | Audit active and inactive profiles | --active, --all |
| nmcli connection up id NAME | Activate a connection | Connect to Ethernet or Wi-Fi profile | ifname, timeout |
| nmcli connection down id NAME | Deactivate a connection | Temporarily disconnect a profile | ifname |
| nmcli device status | Show device state | Verify which interfaces are managed | --porcelain |
| nmcli connection modify id NAME +ipv4.addresses IP/PREFIX | Edit connection settings | Apply static IP or DNS | +ipv4.dns, ipv4.method |
nmcli connection basics
The first step is to understand how nmcli treats connections. Each network profile is stored as a connection, and you can activate or deactivate them without editing files manually. This abstraction makes scripting and remote management more reliable.
Use connection-related commands to list, add, and modify profiles. These operations are safe to run on live systems and provide immediate visibility into how your network is organized.
nmcli device management
Device-level commands show the real hardware or virtual interfaces present on the system. You can bring devices up or down and check whether they are available, enabled, or blocked by policy.
When working with Wi-Fi, bonding, or team interfaces, device commands help you confirm that the kernel driver is loaded and ready for connection activation.
nmcli troubleshooting workflow
When a connection fails, follow a consistent troubleshooting sequence. Check device status first, then verify the active connection, and finally inspect IP configuration and routing.
nmcli provides simple ways to see errors inline, such as when a DHCP timeout occurs or when a bridge or VLAN is misconfigured. Combining connection and device status output narrows down the root cause quickly.
Best practices and advanced usage
Use descriptive connection names, keep one active profile per hardware port where possible, and script repetitive tasks with nmcli -t for machine-parseable output. Pair nmcli with network verification tools to validate DNS, latency, and routing after changes.
- Name connections clearly so they are easy to reference in scripts
- Verify device state before activating a profile
- Use +ipv4.addresses to append addresses instead of replacing existing ones
- Test connectivity after modifying DNS or gateway settings
- Back up connection files periodically when managing multiple nodes
FAQ
Reader questions
How do I switch from DHCP to a static IP without losing connectivity?
Edit the existing connection with nmcli connection modify to set ipv4.method manual, add an ipv4.addresses entry, and provide an ipv4.gateway and ipv4.dns. Activate the same connection again to apply the new addressing while keeping the interface up.
Why does nmcli device disconnect keep failing even though I have root privileges?
The device may be managed by NetworkManager with a keyfile or cloud-init, or it might be in-use by another process. Check nmcli device status for state, review logs with journalctl for denial messages, and ensure the connection is not set to autoconnect on boot.
Can I clone a Wi-Fi profile to a new SSID quickly?
Yes, duplicate the connection by exporting it with nmcli -f all connection show NAME, modify the SSID and security values, and add a new connection with nmcli connection add type wifi con-name NEW_NAME ifname wlan0. Then apply the cloned settings and test connectivity.
How do I debug a bond or team interface that shows as unavailable?
Inspect the device with nmcli device status, verify the mode and slaves using nmcli connection show BONDNAME, and check that each enslaved interface is available and properly configured. Reviewing the teamd or bonding kernel logs often reveals misconfigured sub-interfaces or link failures.