LFCS 100 🐧 NetworkManager — nmcli Basics - KandZ

⏱️ Estimated read: 8 min | |

The nmcli command is the primary interface for NetworkManager. It translates human-readable commands into D-Bus messages that the daemon processes. The LFCS exam tests the command syntax for creating, modifying, activating, and deleting connections, with particular attention to the distinction between modifying a profile (which saves the configuration) and activating it (which applies the configuration to the running device). A common failure is modifying a profile and assuming the change took effect—it did not. The profile is a file; the activation is the act of binding it to a device.

Key point: nmcli connection modify edits the saved profile. nmcli connection up (or nmcli device reapply) applies it. The two operations are separate, and the exam tests both.

Why nmcli exists

The D-Bus abstraction problem. NetworkManager exposes its API over D-Bus. Every operation—listing devices, creating profiles, activating connections—is a D-Bus method call. Writing D-Bus clients by hand is impractical. nmcli wraps these calls in a concise syntax that maps to the NetworkManager object model: nmcli [object] [command] [arguments]. The objects are general, networking, radio, connection, and device. The commands are show, add, modify, up, down, delete .

The profile-versus-device problem. nmcli distinguishes between operating on a connection profile and operating on a device. nmcli connection modify edits the persistent keyfile. nmcli device disconnect and nmcli device reapply operate on the live device. The exam expects you to know which command changes the saved configuration and which changes the running state .

The multi-value property problem. NetworkManager properties like ipv4.addresses, ipv4.dns, and ipv4.routes accept multiple values. nmcli uses prefix operators to control how values are applied: no prefix replaces the entire list, + appends a value, and - removes a specific value . This syntax is tested because it is the difference between overwriting an address and adding a second one.

The persistence problem. nmcli connection add and nmcli connection modify write to /etc/NetworkManager/system-connections/*.nmconnection. The changes survive reboot because the keyfile is persistent. But the running device does not change until the connection is activated. The nmcli device reapply command applies the saved profile without a full disconnect, which is useful on remote systems where a disconnect would terminate the SSH session .

The trade-off. nmcli has a learning curve compared to editing a file. But the command validates settings before writing them, sets the correct file permissions (0600), and triggers the daemon to reload. A hand-edited keyfile requires chmod, chown, and nmcli connection reload to take effect .

a. Listing devices and connections

The show command lists the current state. nmcli device status shows the physical and virtual interfaces, their types, their states, and the connection bound to each. nmcli connection show lists the profiles stored on disk, whether active or inactive .

# List devices and their states
nmcli device status

# List all connection profiles
nmcli connection show

# List only active connections
nmcli connection show --active

The device status output shows connected, disconnected, or unmanaged. A device in disconnected has no active profile. A device in unmanaged is not controlled by NetworkManager. The connection show output lists the profile name (NAME), the UUID, the type, and the device it is bound to (if active). The NAME field is the connection ID, not the interface name—a common source of confusion .

b. Creating and activating a static connection

The connection add command creates a new profile. The required arguments are the type, the interface name, and the connection name. For a static IP, the ipv4.method must be set to manual, and the address, gateway, and DNS are provided as properties .

# Create a static Ethernet profile
sudo nmcli connection add \
    type ethernet \
    con-name static-eth0 \
    ifname enp0s3 \
    ipv4.method manual \
    ipv4.addresses 192.168.1.50/24 \
    ipv4.gateway 192.168.1.1 \
    ipv4.dns 1.1.1.1

The profile is created but not active. The connection up command activates it, binding it to the device and applying the configuration.

# Activate the profile
sudo nmcli connection up static-eth0

For a DHCP connection, omit the manual method and address properties. NetworkManager defaults to ipv4.method auto, which requests an address from a DHCP server .

c. Modifying properties and reapply

The connection modify command edits the saved profile. The change does not affect the running device until the profile is reactivated or reapplied. The prefix operators control multi-value properties .

# Replace the address (no prefix)
sudo nmcli connection modify static-eth0 ipv4.addresses 192.168.1.60/24

# Append a second address (+ prefix)
sudo nmcli connection modify static-eth0 +ipv4.addresses 192.168.1.61/24

# Remove a specific address (- prefix)
sudo nmcli connection modify static-eth0 -ipv4.addresses 192.168.1.61/24

# Append a DNS server
sudo nmcli connection modify static-eth0 +ipv4.dns 8.8.8.8

After modifying, connection up reactivates the profile (dropping the connection briefly). device reapply applies the saved profile to the running device without a full disconnect, which preserves the link .

# Full reactivation
sudo nmcli connection up static-eth0

# Apply without dropping the link
sudo nmcli device reapply enp0s3

Complete Example Session

# ============================================
# PART 1: LIST DEVICES
# ============================================

nmcli device status
# DEVICE  TYPE      STATE         CONNECTION
# enp0s3  ethernet  connected     Wired connection 1
# enp0s8  ethernet  disconnected  --

# ============================================
# PART 2: LIST PROFILES
# ============================================

nmcli connection show
# NAME                 UUID          TYPE      DEVICE
# Wired connection 1   a1b2c3d4-...  ethernet  enp0s3

# ============================================
# PART 3: CREATE A STATIC PROFILE
# ============================================

sudo nmcli connection add \
    type ethernet \
    con-name static-eth0 \
    ifname enp0s8 \
    ipv4.method manual \
    ipv4.addresses 10.0.0.50/24 \
    ipv4.gateway 10.0.0.1 \
    ipv4.dns 8.8.8.8
# Profile created, not yet active.

# ============================================
# PART 4: ACTIVATE THE PROFILE
# ============================================

sudo nmcli connection up static-eth0
# Connection successfully activated.

# ============================================
# PART 5: VERIFY THE DEVICE
# ============================================

nmcli device status
# enp0s8  ethernet  connected  static-eth0

# ============================================
# PART 6: APPEND A SECOND ADDRESS
# ============================================

sudo nmcli connection modify static-eth0 +ipv4.addresses 10.0.0.51/24
# Profile updated, device unchanged.

# ============================================
# PART 7: REAPPLY WITHOUT DISCONNECT
# ============================================

sudo nmcli device reapply enp0s8
# The second address is now active.

# ============================================
# PART 8: VERIFY THE CHANGE
# ============================================

ip addr show enp0s8
# inet 10.0.0.50/24
# inet 10.0.0.51/24

# ============================================
# PART 9: DELETE THE PROFILE
# ============================================

sudo nmcli connection down static-eth0
sudo nmcli connection delete static-eth0

The nine parts trace the nmcli lifecycle: listing, creating, activating, verifying, modifying, reapplying, verifying again, and deleting. The critical distinction is between modify (saves the profile) and reapply or up (applies it).

Quick Reference

Connection Commands

Command	Purpose
`nmcli connection show`	List profiles
`nmcli connection add type ... con-name ...`	Create profile
`nmcli connection modify <name> <prop> <value>`	Edit saved profile
`nmcli connection up <name>`	Activate profile
`nmcli connection down <name>`	Deactivate profile
`nmcli connection delete <name>`	Delete profile

Device Commands

Command	Purpose
`nmcli device status`	List devices and states
`nmcli device reapply <dev>`	Apply saved profile without disconnect
`nmcli device disconnect <dev>`	Disconnect, prevent auto-reconnect

Multi-Value Prefixes

Prefix	Effect
(none)	Replace all values
`+`	Append a value
`-`	Remove a specific value

Best Practices

✅ Do This:

sudo nmcli connection add type ethernet con-name static-eth0 ifname enp0s8 \
    ipv4.method manual ipv4.addresses 10.0.0.50/24
<!-- Create with explicit manual method -->            # ✅

sudo nmcli device reapply enp0s8
<!-- Apply changes without dropping the link -->       # ✅

❌ Don’t Do This:

sudo nmcli connection modify static-eth0 ipv4.addresses 10.0.0.50/24
# Then assume the device changed
<!-- modify only saves the profile -->                 # ❌

sudo nmcli connection add type ethernet con-name static-eth0 ifname enp0s8 \
    ipv4.addresses 10.0.0.50/24
# Missing ipv4.method manual
<!-- Defaults to auto (DHCP) -->                       # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Static IP not applied	`ipv4.method` left as `auto`	Set `ipv4.method manual`
Modify has no effect	Profile saved but not reactivated	`connection up` or `device reapply`
Address replaced instead of added	Missing `+` prefix	Use `+ipv4.addresses`
Cannot delete profile	Profile is active	`connection down` first
Profile not loading	Keyfile permissions	`chmod 600`, owned by `root`

Real-World Examples

1. List Devices

nmcli device status

2. Create Static Profile

sudo nmcli connection add type ethernet con-name static-eth0 ifname enp0s8 \
    ipv4.method manual ipv4.addresses 10.0.0.50/24 ipv4.gateway 10.0.0.1

3. Activate

sudo nmcli connection up static-eth0

4. Append Address

sudo nmcli connection modify static-eth0 +ipv4.addresses 10.0.0.51/24

5. Remove Address

sudo nmcli connection modify static-eth0 -ipv4.addresses 10.0.0.51/24

6. Reapply

sudo nmcli device reapply enp0s8

7. Change DNS

sudo nmcli connection modify static-eth0 ipv4.dns "8.8.8.8 8.8.4.4"

8. Disable Auto-Connect

sudo nmcli connection modify static-eth0 connection.autoconnect no

9. Delete Profile

sudo nmcli connection delete static-eth0

10. Reload Keyfiles

sudo nmcli connection reload

Visual

Modify vs Activate

┌──────────────────────────────────────────────┐
│  nmcli connection modify static-eth0 ...     │
│  (writes to /etc/NetworkManager/             │
│   system-connections/static-eth0.nmconnection)│
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Profile is updated. Device is UNCHANGED.    │
└──────────────────┬───────────────────────────┘
                   │
                   │ nmcli device reapply enp0s8
                   ▼
┌──────────────────────────────────────────────┐
│  Device is updated without dropping link.    │
└──────────────────────────────────────────────┘

The two steps are separate. Skipping the second means the change is not live.

Multi-Value Prefix

┌──────────────────────────────────────────────┐
│  ipv4.addresses 10.0.0.50/24                 │
│  (replaces all addresses)                    │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  +ipv4.addresses 10.0.0.51/24                │
│  (appends a second address)                  │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  -ipv4.addresses 10.0.0.51/24                │
│  (removes the specified address)             │
└──────────────────────────────────────────────┘

The prefix determines the operation.

Summary

Item	Value
List devices	`nmcli device status`
List profiles	`nmcli connection show`
Create profile	`nmcli connection add type ... con-name ...`
Edit profile	`nmcli connection modify <name> <prop>`
Activate	`nmcli connection up <name>`
Apply without disconnect	`nmcli device reapply <dev>`
Append value	`+<property>`
Remove value	`-<property>`
Delete profile	`nmcli connection delete <name>`

Key takeaways:

modify saves the profile; up or reapply applies it. The exam tests the distinction. A modified profile that is not activated does not affect the running device .
ipv4.method manual is required for static addresses. Without it, NetworkManager defaults to DHCP and ignores the static address .
The + and - prefixes control multi-value properties. No prefix replaces the entire list. + appends. - removes a specific value .
device reapply preserves the link. It is the correct tool for applying changes on a remote system where a disconnect would terminate the session.
Keyfiles require 0600 permissions. A hand-edited profile with wrong permissions is ignored by the daemon .

Remember: nmcli is the command-line interface to NetworkManager’s D-Bus API. The commands operate on two distinct objects: connections (profiles) and devices (interfaces). Modifying a connection changes the file. Activating it changes the device. The exam tests both steps and the syntax that controls them.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!