GNU/Linux systems using Network Manager use nmcli to manage the network, hence the name. It differs from ipconfig and iproute2 because it manages the hardware and the configuration files at the same time – in other words all changes are permanent. In Unix you made changes with ifconfig, and if you liked them, added the ifconfig lines to the startup file.
If you’re going to use Network Manager, use it for everything – don’t mix and match or the configuration files will end up out of sync with the actual network interfaces.
| Task | Unix standard | nmcli etc |
|---|---|---|
| List all interfaces | ifconfig | nmcli dev status (interfaces)nmcli con show (profiles) |
| List a specific interface | ifconfig eth0 | nmcli dev show eth0 |
| Bring an interface up or down | ifconfig eth0 up (or down) | nmcli con up eth0 (or down)or nmcli dev connect eth0 / nmcli dev disconnect eth0 |
| Set an IP address | ifconfig eth0 192.168.1.10/24 | nmcli con mod eth0 ipv4.method manual ipv4.addresses 192.168.1.10/24 |
| Configure using DHCP | dhclient eth0 | nmcli con mod eth0 ipv4.method auto |
| Set an IPv6 address | ifconfig eth0 inet6 2001:db8::1/64 | nmcli con mod eth0 ipv6.method manual ipv6.addresses 2001:db8::1/64 |
| Add an AppleTalk address | ifconfig eth0 atalk 45.156 | Only inet supported by GNU/Linux |
| Set IP, netmask and broadcast | ifconfig eth0 192.168.1.10 netmask 255.255.255.0 broadcast 192.168.1.255 | ip addr add 192.168.1.10/24 broadcast 192.168.1.255 dev eth0(not persistent, but Network Manager can’t set broadcast) |
| Add an alias | ifconfig eth0 alias 192.168.1.2 netmask 255.255.255.0 | nmcli con mod eth0 +ipv4.addresses 192.168.1.2/24 |
| Delete a specific IP | ifconfig eth0 delete 192.168.1.2 | nmcli con mod eth0 -ipv4.addresses 192.168.1.2/24 |
| Rename an interface | ifconfig eth0 name wan1 | See notes |
| Show the routing table | netstat -rn | ip route |
| Add a default route | route add default 192.168.1.1 | nmcli con mod eth0 ipv4.gateway 192.168.1.1 |
| Delete a default route | route delete default 192.168.1.1 | nmcli con mod eth0 ipv4.gateway "" |
| Show DNS servers | cat /etc/resolv.conf | nmcli dev show | grep DNS(plain nmcli also lists them at the end) |
| Add a DNS server | Edit /etc/resolv.conf: nameserver 8.8.8.8 | nmcli con mod eth0 +ipv4.dns 8.8.8.8(add ipv4.ignore-auto-dns yes to drop DHCP-supplied servers) |
| Delete all DNS servers | Edit /etc/resolv.conf | nmcli con mod eth0 ipv4.dns "" |
| Set domain search order | Edit /etc/resolv.conf: search example.com local.example.com | nmcli con mod eth0 ipv4.dns-search "example.com,local.example.com" |
| Show listening sockets | netstat -an | ss -tulnp |
| Show interface status | netstat -i | nmcli dev status( ip -s link gives more information, more like netstat |
| Set MTU | ifconfig eth0 mtu 9000 | nmcli con mod eth0 ethernet.mtu 9000 |
| View the ARP cache | arp -a | ip neigh show |
| Delete an ARP entry | arp -d 192.168.1.65 | ip neigh del 192.168.1.65 dev eth0 |
| Delete the ARP cache | arp -d -a | ip neigh flush all |
Notes
At present there are many things that can’t be done or set using nmcli, which might come as a surprise. Systems that don’t have ifconfig usually use ip to fill in the gaps. Note that the iproute2 system (the ip command) doesn’t make changes permanent, whereas nmcli updates the myryad configuration files at the same time as changing the settings. If you want to make a temporary change that doesn’t survive a reboot use ip instead.
There are a few things that nmcli doesn’t do – as far as I know and at time of writing. You can’t manipulate the arp cache with it, so have to use the arp command or “ip neigh xxx”.
One curious omission is that Network Manager can’t set an explicit broadcast address on an interface. It calculates it from the IP address and subnet mask. This is probably okay for most recent IP networks but 4.2BSD used the lowest address rather than the highest and SunOS and Ultrix copied it, so it’s necessary to override it to talk with older hosts. Early GNU/Linux used to calculate the broadcast address from the class, so over-riding was sometimes needed.
The same applies to non inet or inet6 protocols. GNU/Linux simply doesn’t support them so iproute2 and nmcli have no way of setting anything other than IPv4 or IPv6. If you want full-on networking you need BSD.
Network Manager has great difficulty renaming an interface. Create /etc/systemd/network/70-wan1.link containing the following lines, with the MAC address set to whatever the interface is using, and then reboot! If anyone knows a better way I’d love to hear it.
[Match]
MACAddress=xx:xx:xx:xx:xx:xx
[Link]
Name=wan1You can also rename the interface with ip link set eth0 name wan1, but as that doesn’t make it permanent and Network Manager doesn’t know about it, the name might not sick. Perhaps edit the config file and then use ip to set it and hope rather than rebooting immediately.
Philosophy
Whilst iproute2 (the ip command) was a pointless and cumbersome replacement for the ifconfig command, Network Manager does something new. ip is a stateless tool, but NetworkManager is a daemon that manages the network on the system’s behalf. ip talks straight to the kernel over netlink. It changes what is running at that moment, keeps no record of what you did, and doesn’t know or care why an address is there. NetworkManager holds the desired state as connection profiles, each of which complete description of how an interface should be set up: addressing, routes, DNS, MTU, DHCP behaviour and so on. It then works continuously to make the kernel match the profile. Because a profile isn’t tied to a device, one interface can have several (office, home, a static fallback), and you switch between them with a single nmcli con up. When a cable is plugged in, a DHCP lease renews or a USB adapter appears, NetworkManager reapplies the right profile without any help. This is similar to rc.conf combined with /etc/rc.d/netif running all the time, rather than only at boot.
This is also why you shouldn’t make changes with ip on a host running Network Manager. Anything you do behind its back isn’t in a profile, so it vanishes on the next reboot or even network reconnect. Worse, Network Manager may overwrite it straight away or lose track of the interface’s actual state. Going through nmcli keeps one source of truth, and it covers the things iproute2 could never configure anyway, like DNS and /etc/resolv.conf, the DHCP client, Wi-Fi, VPNs, bonds, bridges and VLANs. On systems like RHEL it isn’t really optional anyway. The old network-scripts (ifup/ifdown) were deprecated in RHEL 8 and removed in RHEL 9, along with the ifcfg file format, which gave way to Network Manager’s own config files. More files is better, right? So nmcli is now the supported way to configure the network. ip is still fine for looking around, and for temporary changes you’re happy to lose.