nmcli — Practical NetworkManager CLI Guide & Cheat Sheet

What is nmcli?

nmcli stands for NetworkManager Command Line Interface. NetworkManager is the service that manages network devices and connection profiles on many Linux distributions, including Ubuntu.

Instead of opening a GUI, you can use nmcli to inspect and control:

Wi-Fi networks
Ethernet connections
Saved connection profiles
VPN connections supported by NetworkManager
IP addresses and routes
DNS settings
MAC address policies
Device state and radio state
Connection activation and deactivation
Live network events

A useful mental model is:

Network hardware
       ↓
Kernel driver
       ↓
NetworkManager
       ↓
     nmcli

nmcli talks to NetworkManager. In most cases, it is better to use nmcli than manually changing an interface with low-level tools and then fighting NetworkManager over who is in control.

Command anatomy

The general structure is:

nmcli [OPTIONS] OBJECT COMMAND [ARGUMENTS]

The most common objects are:

Object	What it manages
`general`	Overall NetworkManager state
`networking`	Global networking on/off state
`radio`	Wi-Fi and WWAN radio switches
`device`	Physical/logical network interfaces
`connection`	Saved connection profiles
`monitor`	Live NetworkManager events

Examples:

nmcli general status
nmcli device status
nmcli device wifi list
nmcli connection show
nmcli monitor

1. First commands to learn

Check NetworkManager status

nmcli general status

Useful when networking generally feels broken.

Show all devices

nmcli device status

Example output might show:

DEVICE      TYPE      STATE         CONNECTION
wlp61s0     wifi      connected     HomeWiFi
enp0s31f6   ethernet  unavailable   --
lo          loopback  connected     lo

Typical states include connected, disconnected, unavailable, and unmanaged.

Show saved connection profiles

nmcli connection show

Important: a device and a connection profile are not the same thing.

Device: actual hardware/interface, such as wlp61s0.
Connection: saved configuration, such as HomeWiFi.

One Wi-Fi device can use many saved profiles over time.

2. Working with Wi-Fi

List nearby Wi-Fi networks

nmcli device wifi list

Short form:

nmcli dev wifi list

Useful columns include SSID, BSSID, channel, signal, and security.

Force a fresh scan

nmcli device wifi rescan

Then:

nmcli device wifi list

Connect to a Wi-Fi network

The safest interactive method is:

nmcli device wifi connect "My WiFi" --ask

NetworkManager will ask for the required Wi-Fi password without exposing it in your shell history.

You can specify the device too:

nmcli device wifi connect "My WiFi" ifname wlp61s0 --ask

Connect with the password directly

nmcli device wifi connect "My WiFi" password "your-password"

Be careful: commands may end up in shell history or process listings. --ask is usually better.

Disconnect Wi-Fi

nmcli device disconnect wlp61s0

Turn Wi-Fi off

nmcli radio wifi off

Turn it back on:

nmcli radio wifi on

Check radio state:

nmcli radio all

3. Connection profiles

A connection profile stores configuration such as:

SSID
Wi-Fi security settings
Password secrets
DHCP or static IP configuration
DNS configuration
MAC address policy
Auto-connect behavior

Inspect one profile

nmcli connection show "My WiFi"

Show only active connections

nmcli connection show --active

Bring a connection up

nmcli connection up "My WiFi"

Bring it down

nmcli connection down "My WiFi"

Delete a saved connection

nmcli connection delete "My WiFi"

This deletes the saved profile, not the Wi-Fi network itself. You can create it again by reconnecting.

Rename a connection

nmcli connection modify "Old Name" connection.id "New Name"

4. Device inspection

Detailed information about a device

nmcli device show wlp61s0

Useful fields include:

GENERAL.DEVICE
GENERAL.TYPE
GENERAL.HWADDR
GENERAL.STATE
GENERAL.CONNECTION
IP4.ADDRESS
IP4.GATEWAY
IP4.DNS

To filter the output:

nmcli device show wlp61s0 | grep -E 'GENERAL.HWADDR|GENERAL.CONNECTION|IP4.ADDRESS|IP4.GATEWAY'

Get device status in concise form

nmcli -p device status

-p means pretty output.

5. MAC address randomization

This is one of the most useful features for privacy and troubleshooting.

A Wi-Fi adapter has a permanent factory MAC address, but NetworkManager can present a different address when connecting to a network.

Check the current MAC

nmcli device show wlp61s0 | grep GENERAL.HWADDR

Check the permanent hardware MAC

sudo ethtool -P wlp61s0

Example:

Current MAC:   CA:32:BA:E4:90:50
Permanent MAC: 84:1B:77:8E:60:5C

If they differ, the interface is currently using a cloned/spoofed MAC.

Random MAC for one connection

nmcli connection modify "My WiFi" 802-11-wireless.cloned-mac-address random

Reconnect:

nmcli connection down "My WiFi"
nmcli connection up "My WiFi"

Verify:

nmcli connection show "My WiFi" | grep cloned-mac
nmcli device show wlp61s0 | grep GENERAL.HWADDR

Set a specific MAC address

nmcli connection modify "My WiFi" 802-11-wireless.cloned-mac-address "02:11:22:33:44:55"

A locally administered address is generally preferable for custom addresses. The first octet should indicate a locally administered unicast address; 02:... is a common example.

Restore the permanent MAC for a profile

nmcli connection modify "My WiFi" 802-11-wireless.cloned-mac-address permanent

Use random MACs as a global default

NetworkManager supports configuration defaults. A practical setup is:

[device]
wifi.scan-rand-mac-address=true
 
[connection]
wifi.cloned-mac-address=random

Place the settings in NetworkManager configuration, for example:

sudo nano /etc/NetworkManager/NetworkManager.conf

Then restart NetworkManager:

sudo systemctl restart NetworkManager

Be aware that an individual connection profile can explicitly override the global default.

Scan MAC vs connection MAC

These are different:

wifi.scan-rand-mac-address=true

Randomizes the address used while scanning for nearby Wi-Fi networks.

wifi.cloned-mac-address=random

Controls the address used for the actual Wi-Fi connection.

This distinction matters a lot. Scan randomization alone does not guarantee that your real MAC is hidden after you connect.

6. A real troubleshooting pattern: Wi-Fi connects after changing MAC

A useful diagnostic workflow is:

Confirm that the SSID is visible.
Confirm Wi-Fi is not blocked.
Try connecting normally.
Inspect NetworkManager logs.
Change only the MAC address.
Retry.

Example:

nmcli device wifi connect "TargetSSID" --ask

If it repeatedly fails, try a randomized MAC for that connection:

nmcli connection modify "TargetSSID" 802-11-wireless.cloned-mac-address random
nmcli connection down "TargetSSID"
nmcli connection up "TargetSSID"

If the connection immediately starts working, the MAC identity is a strong suspect.

Possible reasons include:

MAC filtering or access control
A stale router state associated with the old MAC
DHCP/ARP table weirdness
Router firmware bugs
Device restrictions tied to the original MAC

It does not automatically prove that someone intentionally blocked the device. Troubleshooting should distinguish a strong correlation from absolute proof.

7. IP address and DNS

Show current IPv4 information

nmcli device show wlp61s0 | grep '^IP4'

Show current DNS

nmcli device show wlp61s0 | grep DNS

Configure static IPv4

Example:

nmcli connection modify "My WiFi" \
  ipv4.method manual \
  ipv4.addresses "192.168.1.50/24" \
  ipv4.gateway "192.168.1.1" \
  ipv4.dns "1.1.1.1,8.8.8.8"

Reactivate:

nmcli connection down "My WiFi"
nmcli connection up "My WiFi"

Return to DHCP

nmcli connection modify "My WiFi" ipv4.method auto

8. Ethernet

List devices:

nmcli device status

Activate an existing Ethernet profile:

nmcli connection up "Wired connection 1"

Disconnect an interface:

nmcli device disconnect enp0s31f6

Create a simple Ethernet profile:

nmcli connection add type ethernet ifname enp0s31f6 con-name "My Ethernet"

9. Autoconnect

Check the setting:

nmcli connection show "My WiFi" | grep autoconnect

Enable autoconnect:

nmcli connection modify "My WiFi" connection.autoconnect yes

Disable it:

nmcli connection modify "My WiFi" connection.autoconnect no

You can also influence priority:

nmcli connection modify "My WiFi" connection.autoconnect-priority 10

Higher priorities can help NetworkManager choose preferred profiles when multiple known networks are available.

10. Monitoring in real time

This is seriously underrated.

Run:

nmcli monitor

Then connect/disconnect Wi-Fi in another terminal or from the desktop UI.

You can observe NetworkManager state changes live.

For deeper troubleshooting:

journalctl -u NetworkManager -f

Recent logs:

journalctl -u NetworkManager --since "10 minutes ago"

If you accidentally write an invalid relative time, use a concrete expression such as:

journalctl -u NetworkManager --since "5 minutes ago"

or:

journalctl -u NetworkManager --since "2026-08-17 10:00:00"

11. Understanding the Wi-Fi connection process

When connecting to a secured Wi-Fi network, the simplified flow is:

Scan
  ↓
Authenticate
  ↓
Associate with access point
  ↓
WPA/WPA2/WPA3 handshake
  ↓
DHCP request
  ↓
Receive IP configuration
  ↓
DNS and routing configured
  ↓
Connected

When reading logs, failures can happen at different stages.

Authentication failure

Often related to:

Wrong password
Unsupported security mode
Authentication rejection

Association failure

Often related to:

Access point rejecting the device
Signal/driver issues
Router compatibility problems

Handshake failure

Often related to:

WPA security mismatch
Router/client compatibility
Key negotiation problems

DHCP failure

The Wi-Fi association may succeed, but the machine never gets a usable IP address.

Useful command:

nmcli device show wlp61s0

12. Useful Wi-Fi commands cheat sheet

# List devices
nmcli device status
 
# List Wi-Fi networks
nmcli device wifi list
 
# Rescan Wi-Fi
nmcli device wifi rescan
 
# Connect interactively
nmcli device wifi connect "SSID" --ask
 
# Disconnect Wi-Fi device
nmcli device disconnect wlp61s0
 
# Turn Wi-Fi off/on
nmcli radio wifi off
nmcli radio wifi on
 
# Show active connections
nmcli connection show --active
 
# Show all saved profiles
nmcli connection show
 
# Inspect one profile
nmcli connection show "SSID"
 
# Bring a profile up/down
nmcli connection up "SSID"
nmcli connection down "SSID"
 
# Delete a profile
nmcli connection delete "SSID"
 
# Watch events live
nmcli monitor
 
# Watch NetworkManager logs
journalctl -u NetworkManager -f

13. Output filtering tricks

nmcli supports field selection and terse output.

Example:

nmcli -t -f NAME,TYPE,DEVICE connection show

-t means terse output, useful in scripts.

Example output:

HomeWiFi:wifi:wlp61s0
Wired connection 1:ethernet:

Pretty output:

nmcli -p device status

Select fields:

nmcli -f GENERAL.HWADDR,IP4.ADDRESS device show wlp61s0

This is where nmcli becomes very script-friendly.

14. Using nmcli in scripts

Check whether Wi-Fi is connected:

nmcli -t -f GENERAL.STATE device show wlp61s0

Get the active connection name:

nmcli -t -f GENERAL.CONNECTION device show wlp61s0

List active connections:

nmcli -t -f NAME,TYPE connection show --active

A simple Bash example:

#!/usr/bin/env bash
 
STATE=$(nmcli -t -f GENERAL.STATE device show wlp61s0)
 
if [[ "$STATE" == "100 (connected)" ]]; then
  echo "Wi-Fi is connected"
else
  echo "Wi-Fi is not connected"
fi

For scripts, prefer terse or field-filtered output instead of parsing the human-friendly default table.

15. Common troubleshooting workflow

When Wi-Fi refuses to connect, don't randomly reinstall drivers immediately. Work layer by layer.

Step 1: Is the Wi-Fi device available?

nmcli device status

Step 2: Is Wi-Fi enabled?

nmcli radio wifi

Step 3: Is it blocked?

rfkill list

You want Wi-Fi to show:

Soft blocked: no
Hard blocked: no

Step 4: Can the network be seen?

nmcli device wifi list

Step 5: Try connecting interactively

nmcli device wifi connect "SSID" --ask

Step 6: Inspect NetworkManager logs

journalctl -u NetworkManager -f

Step 7: Check IP configuration after connecting

nmcli device show wlp61s0
ip addr show wlp61s0
ip route

Step 8: Test connectivity in layers

ping -c 4 192.168.1.1
ping -c 4 1.1.1.1
ping -c 4 google.com

Interpretation:

Router ping fails → local network problem.
Router works but 1.1.1.1 fails → upstream/internet routing problem.
IP works but domain fails → likely DNS problem.

16. Your MAC-randomization setup

The following configuration is a clean example for Wi-Fi privacy:

[main]
plugins=ifupdown,keyfile
 
[ifupdown]
managed=false
 
[device]
wifi.scan-rand-mac-address=true
 
[connection]
wifi.cloned-mac-address=random

What it does:

Scanning for networks
        ↓
Use randomized scan MAC
 
Connecting to Wi-Fi
        ↓
Use randomized/cloned connection MAC
 
Permanent hardware MAC
        ↓
Not used as the connection identity when the policy applies

Verify with:

nmcli device show wlp61s0 | grep GENERAL.HWADDR
sudo ethtool -P wlp61s0

The current and permanent addresses should differ when randomization is active.

17. Important caveats about random MAC addresses

MAC randomization is useful, but it is not magic anonymity.

A Wi-Fi network can still identify or correlate you using other signals after you authenticate, such as:

Login accounts
Browser fingerprints
Cookies
DHCP behavior
Hostnames
Application traffic

Also, changing MAC addresses can cause problems on networks that depend on MAC identity:

Captive portals
MAC allowlists
DHCP reservations
Device-specific firewall rules
Router parental controls

If a trusted home network uses a DHCP reservation, you may prefer a stable or permanent MAC for that specific connection.

18. Commands worth memorizing

If you only remember ten commands, make them these:

nmcli device status
nmcli device wifi list
nmcli device wifi rescan
nmcli device wifi connect "SSID" --ask
nmcli device disconnect wlp61s0
nmcli connection show
nmcli connection show --active
nmcli connection up "NAME"
nmcli connection down "NAME"
nmcli monitor

And for troubleshooting:

journalctl -u NetworkManager -f
rfkill list
ip addr
ip route

Final takeaway

nmcli is one of those Linux utilities that initially looks boring, then suddenly becomes extremely useful once you understand that NetworkManager stores networking as connection profiles and nmcli gives you direct control over those profiles and devices.

For everyday use, it can replace a surprising amount of GUI clicking. For troubleshooting, it gives you a much clearer picture of what is actually happening: device state, authentication, association, DHCP, DNS, and connection policies.

The MAC-randomization experiment is a perfect example of why it is worth knowing. Instead of guessing why a Wi-Fi network would not connect, you can change one variable, retry, inspect the result, and narrow down the problem.

That is the real superpower here: not memorizing commands, but being able to test networking assumptions systematically.

17. Expanded reference — based on the official docs + ArchWiki + Red Hat guide

The complete top-level command map

nmcli [OPTIONS] OBJECT COMMAND [ARGUMENTS]
 
OBJECTS
├── help
├── general
├── networking
├── radio
├── connection
├── device
├── agent
└── monitor

The two objects you will use most are:

nmcli device ...      → interfaces / hardware
nmcli connection ...  → saved configuration profiles

That distinction is fundamental. A Wi-Fi adapter such as wlp61s0 is a device. Anjum, HomeWiFi, or Waseem Akram are connection profiles containing configuration that NetworkManager can activate on that device.

18. Global options — the stuff that makes nmcli powerful in scripts

nmcli -h
nmcli --help

Show help.

nmcli -v
nmcli --version

Show the installed nmcli version.

nmcli -a ...
nmcli --ask ...

Ask interactively for missing secrets or other required information.

Example:

nmcli --ask device wifi connect "My WiFi"

This is safer than placing a password directly in shell history.

nmcli -f FIELD1,FIELD2 ...
nmcli --fields FIELD1,FIELD2 ...

Choose output fields.

nmcli -f DEVICE,TYPE,STATE device status

nmcli -g GENERAL.HWADDR device show wlp61s0

-g / --get-values is a convenient shortcut for script-friendly value-only output.

nmcli -t ...
nmcli --terse ...

Compact machine-readable output.

nmcli -t -f NAME,TYPE,DEVICE connection show

nmcli -p ...
nmcli --pretty ...

Human-friendly aligned output.

nmcli -m tabular ...
nmcli -m multiline ...

Choose table or multiline output.

nmcli -s connection show "My WiFi"

Show secrets when permitted. Be careful with this: it may expose Wi-Fi passwords in terminal output.

nmcli -w 30 connection up "My WiFi"

Set an operation timeout in seconds. -w 0 tells nmcli not to wait for completion.

nmcli --offline connection add ...

Work with connection data without talking to the running NetworkManager daemon. This is an advanced mode useful for generating or modifying keyfile-style connection data.

19. nmcli general

The general object manages NetworkManager-wide information.

nmcli general status

Show the overall NetworkManager state.

nmcli general hostname

Show the hostname.

sudo nmcli general hostname my-laptop

Set the system hostname through NetworkManager.

nmcli general permissions

Show what operations the current user is authorized to perform.

nmcli general logging

Show NetworkManager logging configuration.

For deeper debugging you can change logging, for example:

sudo nmcli general logging level DEBUG domains WIFI,CORE,DHCP4

Do not leave DEBUG logging enabled forever unless you actually need it.

sudo nmcli general reload

Reload NetworkManager configuration.

Useful variants include:

sudo nmcli general reload conf
sudo nmcli general reload dns-rc
sudo nmcli general reload dns-full

20. Global networking control

nmcli networking

Show whether NetworkManager networking is enabled.

nmcli networking on
nmcli networking off

Enable or disable networking controlled by NetworkManager.

Connectivity checks:

nmcli networking connectivity
nmcli networking connectivity check

Possible results include:

none      → no network connection
portal    → captive portal detected
limited   → network exists but Internet is unavailable
full      → Internet connectivity available
unknown   → connectivity could not be determined

This is useful when Wi-Fi says connected but the Internet still does not work.

21. Radio control

nmcli radio
nmcli radio all

Show radio state.

nmcli radio wifi on
nmcli radio wifi off

Enable or disable Wi-Fi through NetworkManager.

nmcli radio wwan on
nmcli radio wwan off

Control mobile broadband when supported.

nmcli radio all off
nmcli radio all on

Control all supported radios.

If Wi-Fi still refuses to work after nmcli radio wifi on, check:

rfkill list

A hardware kill switch cannot be overridden by nmcli.

22. Connection management — full practical toolkit

The main connection command family is:

nmcli connection
├── show
├── up
├── down
├── modify
├── add
├── edit
├── clone
├── delete
├── monitor
├── reload
├── load
├── import
├── export
└── migrate

Show

nmcli connection show
nmcli connection show --active
nmcli connection show "My WiFi"
nmcli connection show uuid <UUID>

You can separate profile data from active runtime data:

nmcli -f profile connection show "My WiFi"
nmcli -f active connection show "My WiFi"

Activate

nmcli connection up "My WiFi"

Force a specific interface:

nmcli connection up "My WiFi" ifname wlp61s0

For Wi-Fi you can target a specific access point BSSID:

nmcli connection up "My WiFi" ifname wlp61s0 ap AA:BB:CC:DD:EE:FF

Deactivate

nmcli connection down "My WiFi"

Important: connection down deactivates the profile but the device may later auto-connect to another suitable profile.

Modify

General pattern:

nmcli connection modify "PROFILE" setting.property value

Examples:

nmcli connection modify "My WiFi" connection.autoconnect yes
nmcli connection modify "My WiFi" connection.autoconnect-priority 10
nmcli connection modify "My WiFi" ipv4.method auto

Reset a property to its default with an empty value:

nmcli connection modify "My WiFi" ipv4.dns ""

Append to multi-value properties using +:

nmcli connection modify "My WiFi" +ipv4.dns 1.1.1.1
nmcli connection modify "My WiFi" +ipv4.dns 8.8.8.8

Temporary changes can be made with:

nmcli connection modify --temporary "My WiFi" connection.autoconnect no

Add a connection

DHCP Ethernet example:

nmcli connection add type ethernet ifname enp0s31f6 con-name "Office DHCP"

Static Ethernet example:

nmcli connection add type ethernet ifname enp0s31f6 con-name "Office Static" \
  ipv4.method manual \
  ipv4.addresses 192.168.1.50/24 \
  ipv4.gateway 192.168.1.1 \
  ipv4.dns "1.1.1.1,8.8.8.8"

Interactive editor

nmcli connection edit "My WiFi"

Or create a new profile interactively:

nmcli connection edit type wifi con-name "Test WiFi"

This is useful when you want a guided text interface instead of remembering every property name.

Clone

nmcli connection clone "My WiFi" "My WiFi Test"

This creates a copy with a new connection name and UUID.

Delete

nmcli connection delete "My WiFi"

Delete by UUID if names are ambiguous:

nmcli connection delete uuid <UUID>

Monitor profiles

nmcli connection monitor
nmcli connection monitor "My WiFi"

Reload or load profiles

If you manually edit connection files:

sudo nmcli connection reload

Load a specific connection file:

sudo nmcli connection load /path/to/connection.nmconnection

Import and export

NetworkManager supports importing/exporting supported VPN configurations when the appropriate VPN plugin is installed.

nmcli connection import type openvpn file client.ovpn
nmcli connection export "My VPN" backup.ovpn

Actual supported types depend on installed VPN plugins.

23. Device management — beyond just Wi-Fi

The device family is:

nmcli device
├── status
├── show
├── set
├── up / connect
├── reapply
├── modify
├── down / disconnect
├── delete
├── monitor
├── wifi
├── lldp
└── checkpoint

Status and details

nmcli device status
nmcli device show
nmcli device show wlp61s0

Enable or disable autoconnect for a device

nmcli device set wlp61s0 autoconnect yes
nmcli device set wlp61s0 autoconnect no

Connect a device using the best available profile

nmcli device up wlp61s0
nmcli device connect wlp61s0

Unlike connection up, this asks NetworkManager to find a suitable profile for the device.

Reapply active profile changes

nmcli device reapply wlp61s0

Useful after changing a connection when supported properties can be applied without a full reconnect.

Temporary runtime changes

nmcli device modify wlp61s0 ipv4.dns 1.1.1.1

Device modifications are runtime-oriented and are not necessarily saved back into the connection profile.

Disconnect a device

nmcli device down wlp61s0
nmcli device disconnect wlp61s0

This is usually the better choice when you want the device itself to stop automatically reconnecting.

Delete a software device

nmcli device delete br0

This applies to software interfaces such as bridges; physical Wi-Fi/Ethernet hardware cannot be deleted this way.

Monitor device state

nmcli device monitor
nmcli device monitor wlp61s0

24. Wi-Fi command reference

List access points

nmcli device wifi list
nmcli device wifi list ifname wlp61s0

Filter to a BSSID:

nmcli device wifi list bssid AA:BB:CC:DD:EE:FF

Control rescanning behavior:

nmcli device wifi list --rescan yes
nmcli device wifi list --rescan no

Force a scan

nmcli device wifi rescan

Target a device:

nmcli device wifi rescan ifname wlp61s0

Scan specifically for a hidden SSID:

nmcli device wifi rescan ssid "HiddenNetwork"

Connect

Interactive:

nmcli device wifi connect "SSID" --ask

With password:

nmcli device wifi connect "SSID" password "PASSWORD"

Specific adapter:

nmcli device wifi connect "SSID" ifname wlp61s0 --ask

Hidden network:

nmcli device wifi connect "HiddenSSID" hidden yes --ask

Choose a custom profile name:

nmcli device wifi connect "SSID" name "My Custom Profile" --ask

Restrict the profile to one AP BSSID:

nmcli device wifi connect "SSID" bssid AA:BB:CC:DD:EE:FF --ask

Create a hotspot

Quick hotspot:

nmcli device wifi hotspot ifname wlp61s0 ssid "Wasii-Hotspot" password "StrongPassword123"

Choose a profile name, band, and channel:

nmcli device wifi hotspot \
  ifname wlp61s0 \
  con-name "My Hotspot" \
  ssid "Wasii-Hotspot" \
  band a \
  channel 36 \
  password "StrongPassword123"

Stop it:

nmcli connection down "My Hotspot"

Show the active Wi-Fi password/details

nmcli device wifi show-password

Use carefully if other people can see your terminal.

25. LLDP and network discovery

When LLDP is enabled for a connection, NetworkManager can display neighboring network devices:

nmcli device lldp list
nmcli device lldp list ifname enp0s31f6

This can be useful in enterprise networks for identifying the switch or neighboring network equipment.

26. The underrated safety feature: checkpoints

If you are changing network settings remotely, you can accidentally lock yourself out. checkpoint provides a rollback safety net.

Conceptually:

Save current network state
        ↓
Run risky network command
        ↓
Confirm if successful
        ↓
Otherwise automatically restore previous state

Example pattern:

nmcli device checkpoint --timeout 60 -- wlp61s0

The exact use is particularly valuable for remote administration. Check your installed version's nmcli device checkpoint --help output before using it in production.

27. IP addressing, routes, and DNS — expanded examples

DHCP

nmcli connection modify "My WiFi" ipv4.method auto
nmcli connection up "My WiFi"

Static IPv4

nmcli connection modify "My WiFi" \
  ipv4.method manual \
  ipv4.addresses "192.168.100.50/24" \
  ipv4.gateway "192.168.100.1" \
  ipv4.dns "1.1.1.1,8.8.8.8"

Prevent DHCP-provided DNS from overriding yours:

nmcli connection modify "My WiFi" ipv4.ignore-auto-dns yes

Add search domains:

nmcli connection modify "My WiFi" +ipv4.dns-search example.local

Add another IPv4 address

nmcli connection modify "My WiFi" +ipv4.addresses 192.168.100.51/24

Add a route

Modern NetworkManager route syntax can vary by version, so inspect supported properties first:

nmcli connection show "My WiFi" | grep -i route

Then use the version-appropriate ipv4.routes property syntax documented by your installed NetworkManager.

IPv6

Show IPv6 information:

nmcli device show wlp61s0 | grep '^IP6'

Automatic IPv6:

nmcli connection modify "My WiFi" ipv6.method auto

Disable IPv6 for a specific profile:

nmcli connection modify "My WiFi" ipv6.method disabled

28. MAC randomization — corrected and improved configuration

There are two different things:

Scan randomization — what MAC is used while searching for Wi-Fi networks.
Connection randomization — what MAC is used after actually connecting.

For persistent configuration, using a dedicated drop-in under /etc/NetworkManager/conf.d/ is cleaner than modifying the main file directly.

Recommended file:

sudo nano /etc/NetworkManager/conf.d/wifi-mac-randomization.conf

Example configuration matching your current goal:

[device-mac-randomization]
wifi.scan-rand-mac-address=yes
 
[connection-mac-randomization]
wifi.cloned-mac-address=random

Then reload or restart NetworkManager:

sudo nmcli general reload conf
sudo systemctl restart NetworkManager

`stable` versus `random`

stable
→ Generates a privacy-preserving MAC associated with a network.
→ The same network normally receives the same generated identity.
→ Better for networks that expect a consistent device identity.
 
random
→ A new random MAC can be generated on each connection activation.
→ Better for maximum rotation/privacy.
→ Can annoy captive portals, MAC allowlists, DHCP reservations, and networks that track devices by MAC.

For many people, stable is the best default balance. Your explicit choice of random makes sense when you specifically want a fresh identity on reconnection.

Per-profile override

nmcli connection modify "My WiFi" 802-11-wireless.cloned-mac-address stable

Random:

nmcli connection modify "My WiFi" 802-11-wireless.cloned-mac-address random

Permanent hardware address:

nmcli connection modify "My WiFi" 802-11-wireless.cloned-mac-address permanent

Specific address:

nmcli connection modify "My WiFi" 802-11-wireless.cloned-mac-address 02:11:22:33:44:55

Verify current versus permanent identity:

nmcli -g GENERAL.HWADDR device show wlp61s0
sudo ethtool -P wlp61s0

29. Temporary versus persistent changes

This distinction saves a lot of confusion.

nmcli connection modify
→ Changes the saved profile persistently.
 
nmcli connection modify --temporary
→ Changes exist only until NetworkManager restarts or the temporary profile state disappears.
 
nmcli device modify
→ Runtime changes to the active device; generally not saved back as profile configuration.

Before making a permanent change, inspect the profile:

nmcli connection show "My WiFi"

30. Connection secrets and safer authentication

Interactive password prompt:

nmcli --ask device wifi connect "SSID"

For automation, a password file can be used for supported activation workflows:

802-11-wireless-security.psk:your-secret

Then activate using the password-file option where appropriate.

Avoid putting secrets directly into shell history whenever possible.

31. NetworkManager agents

nmcli agent secret

Run nmcli as a secret agent.

nmcli agent polkit

Run nmcli as a text-based PolicyKit agent.

nmcli agent all

Run both.

These are niche commands, but useful on headless or minimal systems where a desktop secret/polkit agent is unavailable.

32. Monitoring and forensic troubleshooting workflow

Start with:

nmcli monitor

For connection-specific events:

nmcli connection monitor "My WiFi"

For device-specific events:

nmcli device monitor wlp61s0

For detailed daemon logs:

journalctl -u NetworkManager -f

Recent logs:

journalctl -u NetworkManager --since "10 minutes ago"

More focused output:

journalctl -u NetworkManager -b

Current boot only.

Useful live diagnostic workflow:

# Terminal 1
journalctl -u NetworkManager -f
 
# Terminal 2
nmcli device wifi rescan ifname wlp61s0
nmcli device wifi list
nmcli --ask device wifi connect "SSID"

Watch which stage fails:

scan
→ authentication
→ association
→ WPA handshake
→ DHCP
→ IP configuration
→ connectivity

Do not reinstall drivers before identifying the failing layer. That is the Linux equivalent of replacing the whole engine because the car ran out of fuel.

33. Troubleshooting specific failure patterns

Wi-Fi device unavailable

nmcli device status
rfkill list
ip link show wlp61s0

Check driver information:

lspci -k | grep -A 3 -i network

For USB Wi-Fi:

lsusb

Password/secrets errors

Inspect logs:

journalctl -u NetworkManager --since "5 minutes ago"

Sometimes a failed association or timeout can eventually surface as a request for secrets even when the password itself was correct. Deleting and recreating a broken profile is a valid diagnostic step:

nmcli connection delete "SSID"
nmcli --ask device wifi connect "SSID"

Connected but no Internet

nmcli networking connectivity check
ip route
resolvectl status
ping -c 3 1.1.1.1
ping -c 3 google.com

Interpretation:

1.1.1.1 works, domain fails
→ likely DNS issue
 
No route / gateway
→ IP or DHCP issue
 
Connectivity says portal
→ captive portal login required

MAC-specific weirdness

Compare current and permanent MAC:

nmcli -g GENERAL.HWADDR device show wlp61s0
sudo ethtool -P wlp61s0

Try a controlled per-profile test:

nmcli connection modify "SSID" 802-11-wireless.cloned-mac-address random
nmcli connection down "SSID"
nmcli connection up "SSID"

If changing only the MAC fixes the issue, suspect router-side access control, stale state, DHCP behavior, or a firmware bug — but do not automatically claim deliberate blocking without checking the router.

34. Advanced connection types

NetworkManager can manage far more than Wi-Fi and Ethernet. Depending on installed plugins and kernel support, connection types include examples such as:

wifi
ethernet
bridge
bond
vlan
vpn
wireguard
pppoe
bluetooth
gsm
macvlan
veth
tun
vxlan
vrf
loopback

Examples of useful creation patterns:

Bridge

nmcli connection add type bridge ifname br0 con-name br0

VLAN

nmcli connection add type vlan ifname vlan10 dev enp0s31f6 id 10 con-name vlan10

WireGuard

The exact workflow depends on the NetworkManager version and available WireGuard support. Start by checking:

nmcli connection add help

Then inspect supported properties with:

nmcli connection show
nmcli connection edit type wireguard

For complex connection types, the interactive editor is often less error-prone than guessing property names.

35. Script-friendly patterns

Get the active connection on an interface:

nmcli -g GENERAL.CONNECTION device show wlp61s0

Get the current MAC only:

nmcli -g GENERAL.HWADDR device show wlp61s0

List only active profile names and types:

nmcli -t -f NAME,TYPE connection show --active

Check connectivity in a script:

if [[ "$(nmcli -g STATE general)" == "connected" ]]; then
  echo "NetworkManager reports a connection"
fi

Check Wi-Fi radio:

nmcli -g WIFI general

A robust pattern is to request only the fields you need rather than parsing columns designed for humans.

36. How to discover properties instead of memorizing everything

You do not need to memorize every NetworkManager property. Use discovery.

nmcli connection show "My WiFi"

Search for relevant properties:

nmcli connection show "My WiFi" | grep -i dns
nmcli connection show "My WiFi" | grep -i mac
nmcli connection show "My WiFi" | grep -i route
nmcli connection show "My WiFi" | grep -i autoconnect

Use the interactive editor for guided discovery:

nmcli connection edit "My WiFi"

Ask for help:

nmcli help
nmcli connection help
nmcli device help
nmcli device wifi help
nmcli connection modify help

This is the real superpower: nmcli is large enough that nobody sane memorizes every property.

37. Recommended command cheat sheet

# Status
nmcli general status
nmcli device status
nmcli connection show --active
 
# Wi-Fi
nmcli device wifi list
nmcli device wifi rescan ifname wlp61s0
nmcli --ask device wifi connect "SSID"
nmcli device disconnect wlp61s0
nmcli radio wifi on
nmcli radio wifi off
 
# Profiles
nmcli connection show
nmcli connection show "PROFILE"
nmcli connection up "PROFILE"
nmcli connection down "PROFILE"
nmcli connection delete "PROFILE"
nmcli connection clone "PROFILE" "PROFILE-copy"
nmcli connection edit "PROFILE"
 
# IP / DNS
nmcli device show wlp61s0
nmcli -f GENERAL,IP4,DHCP4 device show wlp61s0
nmcli connection modify "PROFILE" ipv4.method auto
nmcli connection modify "PROFILE" ipv4.ignore-auto-dns yes
nmcli connection modify "PROFILE" +ipv4.dns 1.1.1.1
 
# MAC
nmcli -g GENERAL.HWADDR device show wlp61s0
sudo ethtool -P wlp61s0
nmcli connection modify "PROFILE" 802-11-wireless.cloned-mac-address random
nmcli connection modify "PROFILE" 802-11-wireless.cloned-mac-address stable
nmcli connection modify "PROFILE" 802-11-wireless.cloned-mac-address permanent
 
# Monitoring
nmcli monitor
nmcli device monitor wlp61s0
nmcli connection monitor "PROFILE"
journalctl -u NetworkManager -f
 
# Connectivity
nmcli networking connectivity check
ip route
resolvectl status
rfkill list
 
# Output for scripts
nmcli -t -f NAME,TYPE,DEVICE connection show
nmcli -g GENERAL.CONNECTION device show wlp61s0
nmcli -g GENERAL.HWADDR device show wlp61s0

38. Sources and further reading