nmcli Cheat Sheet
nmcli # overview of every device and its connection
nmcli dev status # devices and their state
nmcli dev wifi list # visible Wi-Fi networks
nmcli dev wifi connect 'HomeNet' --ask # join a network, prompt for the password
nmcli con show # saved connection profiles
sudo nmcli con up 'HomeNet' # activate (or re-apply) a profilenmcli controls NetworkManager, the network service on Ubuntu Desktop, Fedora, Linux Mint, openSUSE, Arch with a desktop and most other desktop installs. Ubuntu Server uses netplan with systemd-networkd instead, so check that NetworkManager is running first: systemctl is-active NetworkManager. Unlike the ip command, nmcli changes are saved in profiles and survive reboots. Objects and commands abbreviate: dev/d, con/c, show/s, modify/mod. Tab completion works for connection names.
Status and devices
| Command | What it does |
|---|---|
nmcli | Summary of devices, addresses, routes and DNS |
nmcli general status | Overall state and connectivity (full, limited, portal) |
nmcli dev status | Each interface: type, state, active connection |
nmcli dev show wlp2s0 | Addresses, gateway, DNS and MAC of one device |
sudo nmcli dev connect enp3s0 | Activate the best profile on a device |
sudo nmcli dev disconnect wlp2s0 | Disconnect and stop auto-connecting until told otherwise |
sudo nmcli dev reapply enp3s0 | Apply profile changes without a full disconnect |
nmcli radio | Wi-Fi and WWAN radio switches |
nmcli radio wifi off / on | Turn Wi-Fi off or on |
sudo nmcli dev set enp3s0 managed no | Tell NetworkManager to leave an interface alone |
nmcli monitor | Watch state changes live |
Wi-Fi
| Command | What it does |
|---|---|
nmcli dev wifi list | Networks in range with signal, channel and security |
nmcli dev wifi rescan | Force a new scan |
nmcli dev wifi connect 'SSID' --ask | Connect and prompt for the password (keeps it out of shell history) |
nmcli dev wifi connect 'SSID' password 'secret' | Connect non-interactively |
nmcli dev wifi connect 'SSID' --ask hidden yes | Connect to a hidden network |
nmcli dev wifi show-password | Show the current network's password and a QR code |
sudo nmcli dev wifi hotspot ssid MyHotspot password 'longpassword' | Turn the Wi-Fi card into an access point |
nmcli -f SSID,BSSID,CHAN,SIGNAL dev wifi list | Choose columns (find the strongest access point) |
If no networks appear at all, the problem is usually the driver or firmware; see Wi-Fi not working on Linux.
Connection profiles
| Command | What it does |
|---|---|
nmcli con show | All saved profiles (--active for active only) |
nmcli con show 'NAME' | Every setting of one profile |
sudo nmcli con up 'NAME' | Activate a profile (also re-applies edits) |
sudo nmcli con down 'NAME' | Deactivate it |
sudo nmcli con mod 'NAME' connection.autoconnect no | Stop it connecting automatically |
sudo nmcli con mod 'NAME' connection.autoconnect-priority 10 | Prefer this profile over others |
sudo nmcli con mod 'Wired connection 1' connection.id office | Rename a profile |
sudo nmcli con delete 'NAME' | Delete a profile (forget a network) |
sudo nmcli con reload | Re-read profile files edited by hand |
sudo nmcli con export 'VPN' | Export a VPN profile |
sudo nmcli con import type wireguard file wg0.conf | Import a WireGuard (or openvpn) config |
Profiles are stored in /etc/NetworkManager/system-connections/ (keyfiles, readable by root only).
IP address, gateway and DNS
| Command | What it does |
|---|---|
sudo nmcli con mod 'NAME' ipv4.method manual ipv4.addresses 192.168.1.50/24 ipv4.gateway 192.168.1.1 | Static IPv4 address and gateway |
sudo nmcli con mod 'NAME' ipv4.dns '1.1.1.1 9.9.9.9' | Set DNS servers |
sudo nmcli con mod 'NAME' ipv4.ignore-auto-dns yes | Use only your DNS servers, not the ones DHCP hands out |
sudo nmcli con mod 'NAME' +ipv4.addresses 192.168.1.51/24 | Add a second address (+ appends, - removes) |
sudo nmcli con mod 'NAME' ipv4.method auto ipv4.addresses '' ipv4.gateway '' | Back to DHCP |
sudo nmcli con mod 'NAME' +ipv4.routes '10.20.0.0/16 192.168.1.5' | Add a static route |
sudo nmcli con mod 'NAME' ipv6.method disabled | Disable IPv6 on this profile |
sudo nmcli con mod 'NAME' 802-3-ethernet.mtu 9000 | Set MTU on a wired profile |
sudo nmcli con add type ethernet ifname enp3s0 con-name lan ipv4.method manual ipv4.addresses 10.0.0.5/24 | Create a new wired profile from scratch |
Changes to a profile take effect the next time it is activated, so finish with sudo nmcli con up 'NAME'. The static IP guide covers netplan and systemd-networkd too.
Common recipes
Switch the wired connection to a static address in one go and apply it:
nmcli -g NAME,DEVICE con show --active
sudo nmcli con mod 'Wired connection 1' \
ipv4.method manual ipv4.addresses 192.168.1.50/24 \
ipv4.gateway 192.168.1.1 ipv4.dns '192.168.1.1 1.1.1.1'
sudo nmcli con up 'Wired connection 1'Show the address, gateway and DNS of the active connections in script-friendly form:
nmcli -g IP4.ADDRESS,IP4.GATEWAY,IP4.DNS dev show wlp2s0Restart networking without rebooting:
sudo nmcli networking off && sudo nmcli networking on
sudo systemctl restart NetworkManager # heavier: restarts the serviceFix DNS names not resolving on a connection (see Temporary failure in name resolution):
sudo nmcli con mod 'NAME' ipv4.dns '1.1.1.1 9.9.9.9' ipv4.ignore-auto-dns yes
sudo nmcli con up 'NAME'
resolvectl statusSet the hostname through NetworkManager:
sudo nmcli general hostname web01Find NetworkManager's own log entries:
journalctl -u NetworkManager -b --no-pager | tail -50Gotchas
- Edits do not apply themselves.
nmcli con modonly changes the saved profile. Runnmcli con up NAMEornmcli dev reapply DEV. - Profile names contain spaces. Quote them:
'Wired connection 1'. Usenmcli con showto get the exact name or UUID. - Over SSH, changing the IP drops your session. Have console access, or run the change with
nohupor in tmux so it completes after you lose the connection. - Passwords on the command line.
password 'secret'ends up in your shell history and inps. Use--ask. - Not every interface is managed. On Ubuntu Server, netplan or systemd-networkd may own the interface and nmcli shows it as
unmanaged. Edit/etc/netplan/*.yamlthere instead. - Hotspot fails on some cards. The driver must support AP mode: check
iw list | grep -A10 'Supported interface modes'.
Every setting is documented in nmcli(1) and nm-settings-nmcli(5) on the NetworkManager project site.
Frequently asked questions
How do I connect to Wi-Fi with nmcli?
List networks with nmcli dev wifi list, then run nmcli dev wifi connect 'SSID' --ask and type the password at the prompt. NetworkManager saves the profile and reconnects automatically.
How do I set a static IP with nmcli?
Modify the connection profile: sudo nmcli con mod 'NAME' ipv4.method manual ipv4.addresses 192.168.1.50/24 ipv4.gateway 192.168.1.1 ipv4.dns '1.1.1.1 9.9.9.9', then apply it with sudo nmcli con up 'NAME'.
How do I see a saved Wi-Fi password?
Run nmcli dev wifi show-password for the current network, or sudo nmcli -s -g 802-11-wireless-security.psk con show 'NAME' for any saved profile.
What is the difference between a device and a connection in nmcli?
A device is a network interface such as wlp2s0. A connection is a saved profile of settings (SSID, password, IP method) that NetworkManager activates on a device. One device can have many profiles.
Is there a menu version of nmcli?
Yes, nmtui gives a text menu for editing connections, activating them and setting the hostname. It ships with NetworkManager on most distros (package network-manager or NetworkManager-tui).
Spotted a mistake or a command that no longer works? Send a correction — pages are re-checked when reports come in.