Managing wireless networks in Linux-based operating systems often presents difficulties for users accustomed to the graphical interfaces of Windows or macOS. However, when it comes to server solutions or minimalist distributions, a tool comes to the forefront. NetworkManager, or rather, its console utility nmcliThis is a powerful tool that allows you to monitor network connections without having to reboot the system or use heavy-duty graphical shells.
Unlike the outdated one wpa_cli or manual editing of configuration files, nmcli Offers a logical command structure that's intuitive even for beginners after a quick introduction. It lets you not only connect to your router, but also create complex profiles, manage network priorities, and even simulate access points. Understanding how this tool works is essential. a fundamental skill for any Linux system administrator, working with network infrastructure.
In this article, we'll cover the entire connection process in detail: from checking adapter status to fine-tuning security settings. You'll learn how to automate the connection process, what to do if the system can't detect your network, and how to diagnose problems at a low level. Proper use of the command line saves time and gives you complete control over your operating system's network stack.
Checking the status and preparing the interface
Before attempting to connect to any network, you must ensure that your wireless adapter is physically functional, the drivers are installed correctly, and the interface itself is enabled. The first step should always be to run the command nmcli radio wifi, which will show whether the Wi-Fi radio module is enabled at all. It often happens that the interface is blocked at the software or hardware level, and no connection attempts will be successful without prior activation.
To get detailed information about available devices, use the command nmcli device or its shortened version nmcli dIn the output, you'll see a list of all network cards, their type (ethernet, wifi), and current status. You're interested in the STATE column: if it says disconnected, which means the device is ready to work, but not connected. Status unmanaged indicates that NetworkManager does not control this device and it needs to be added to management or its configuration files need to be checked.
If Wi-Fi is disabled, it can be enabled with one simple command without rebooting. This is especially convenient for remote administration when the graphical interface is unavailable or won't start. After enabling it, it's recommended to immediately check the list of available networks to ensure scanning is working correctly and the adapter is responding to requests.
nmcli radio wifi onScanning available networks and signal analysis
The next step is to search for nearby access points. The command nmcli device wifi list (or shortly nmcli d w l) will display a table with all visible networks. This list displays the SSID (network name), security mode, channel, and, most importantly, signal strength (SIGNAL). The higher the signal percentage, the more stable the connection will be, but it is worth considering that neighboring networks on the same channel may create interference.
When analyzing the list, pay attention to the SECURITY column. If it says WPA2 or WPA3These are modern and secure protocols. If you see open networks (without a password), the system may mark them as such, but connecting to them unnecessarily is not recommended for security reasons. Sometimes the desired network may not be listed if it is hidden (has a hidden SSID)—in this case, you will have to enter the name manually.
For a more detailed analysis, you can filter the output or sort it, although the standard nmcli does not have built-in complex filters, so it is often used in conjunction with grepFor example, to find a network by part of its name, you can run nmcli d w l | grep -i"Home"This will help you quickly navigate the list if you're surrounded by dozens of neighboring routers.
⚠️ Attention: The network list doesn't update instantly. If you've just turned on your router or changed its settings, it may take a few seconds or require you to rerun the scan command for the data to update.
Connecting to an open and secure network
The most common scenario is connecting to a password-protected home or office network. To do this, use the command nmcli device wifi connect, followed by the network's SSID and password. The syntax is extremely simple: you enter the network name in quotation marks (if the name contains spaces) and the password. The system will automatically attempt to create a connection profile and activate it.
nmcli device wifi connect"MyHomeWiFi" password"SuperSecretPassword123"If the network is open and does not require a password, the password parameter can be omitted or an empty string can be explicitly specified, although most often nmcli It will automatically detect that the network is open when you try to connect. If the connection is successful, the system will display a message stating that the device has been successfully activated and will assign the connection status connectedIf the password is incorrect, you will receive a clear "authentication failed" error message, making diagnostics easier.
☑️ Check before connection
It is important to note that when you first connect nmcli Creates a persistent connection profile. This means that the next time you restart your computer or turn on Wi-Fi, the system will automatically attempt to connect to this network using the saved credentials. You won't have to enter the password again unless you decide to delete this profile.
Working with hidden networks and
The situation becomes more complicated if your target network is hidden (Hidden SSID). In this case, it won't appear in the list during scanning, as the router doesn't broadcast its name. To connect, you need to explicitly specify the network name and add a flag. hidden yes to the connect command. This forces NetworkManager to actively search for a specific network, even if it's not currently visible.
nmcli device wifi connect"SecretOffice" password"ComplexPass" hidden yesNetworks that contain special characters, spaces, or symbols interpreted by the shell (for example, $, !, #). In such cases, it is extremely important to properly escape strings. Using single quotes ' instead of doubles often helps to avoid problems with the interpretation of variables by a shell script.
What to do if the password contains a backslash?
If your password contains the '\' character, it must be escaped with a double slash '\\', otherwise it will be interpreted as an escape sequence.
It's also worth keeping character encoding in mind. While UTF-8 has become the standard, some older routers or specific settings may require entering a password in a specific encoding. If a standard connection doesn't work, try changing the terminal locale before running the command, although modern Linux distributions handle this automatically in 99% of cases.
Managing connection profiles
Once a connection is created, it is saved as a profile that can be managed regardless of the current network state. Command nmcli connection (or nmcli c) allows you to view, edit, and delete saved configurations. This is especially useful if you've moved to a new office and an old profile with a similar name is causing conflicts, or if you've changed your Wi-Fi password.
To see all saved profiles, use the command nmcli connection showIn the list, you will see the profile name (NAME), device type (DEVICE), and current status. If the profile is active, the DEVICE column will indicate the interface name (e.g., wlo1). To delete an unnecessary profile, use the command nmcli connection delete"Profile_Name".
| Team | Description of action | Example of use |
|---|---|---|
nmcli c show |
Show all profiles | nmcli c show |
nmcli c up |
Activate profile | nmcli c up"Home" |
nmcli c down |
Deactivate profile | nmcli c down"Home" |
nmcli c delete |
Delete profile | nmcli c delete"OldCafe" |
Editing the parameters of an existing profile allows you to change settings without completely reconnecting. For example, you can change the IP address acquisition method from DHCP to static without re-entering the Wi-Fi password. To do this, use the modify, followed by the profile name and the parameter to be changed, for example, ipv4.method manual.
Setting up a static IP address
Corporate networks or servers often require a fixed IP address so that other devices can reliably find your computer. By default nmcli uses dynamic address acquisition (DHCP), but you can switch to a static address by modifying your profile. You'll need to know your network's gateway, subnet mask, and DNS servers.
The process of setting up a static address looks like a sequence of modification commands. First, we change the method from auto on manual, then enter the address, gateway, and DNS. It's important to execute these commands for a specific connection profile, otherwise the changes won't be applied. After changing the settings, you'll need to reconnect the profile.
nmcli connection modify"MyHomeWiFi" ipv4.method manualnmcli connection modify"MyHomeWiFi" ipv4.addresses 192.168.1.50/24
nmcli connection modify"MyHomeWiFi" ipv4.gateway 192.168.1.1
nmcli connection modify"MyHomeWiFi" ipv4.dns"8.8.8.8 1.1.1.1"
After making all the changes, you need to reactivate the connection with the command nmcli connection up"MyHomeWiFi"If you make a mistake in the address or gateway, the connection will fail, and the system will revert to the previous working configuration or be left without network access. Therefore, double-checking the data before use is critical.
⚠️ Attention: Make sure that the static IP address you select is not within the range of addresses distributed by the router's DHCP server, otherwise an address conflict will occur and the network will crash for both devices.
Diagnostics and troubleshooting
Even experienced users encounter situations where a connection fails. The first diagnostic tool to use should be viewing the NetworkManager logs. The command nmcli general logging allows you to control the logging level, but for quick error detection it is better to use the system log journalctl with filter by NetworkManager.
A common issue is a faulty driver or a stuck Wi-Fi module. Restarting the NetworkManager service with the command systemctl restart NetworkManagerThis is a safe operation that doesn't require a system reboot, but it may temporarily interrupt existing connections. It's also worth checking to see if your firewall is blocking necessary ports or protocols.
How to find out the MAC address for filtering?
Use the 'nmcli device show' command to find the GENERAL.HWADDR parameter - this is the physical address of your card, which can be entered in the router settings.
If the problem persists, try creating a new profile from scratch, rather than relying on automatic settings. Sometimes cached data from an old profile can interfere with a proper handshake with the router, especially after updating the access point's firmware or changing encryption standards from WPA2 to WPA3.
Why does nmcli say "Secrets were required, but not provided"?
This error means that a password (WPA-PSK key) is required to connect, but you did not specify one in the command, and interactive input is not possible or disabled in this environment. Add the parameter password"your_password" to the connection command.
How to connect to Wi-Fi without a password (open network)?
Just use the command nmcli device wifi connect"Network_Name" without specifying the password parameter. The system will automatically detect the lack of encryption and establish a connection.
Where are Wi-Fi passwords stored in Linux?
By default, profiles and passwords (in encrypted or clear form depending on the distribution) are stored in files in the directory /etc/NetworkManager/system-connections/Only root has access to them.
Can nmcli be used in a Docker container?
Technically, it is possible, but for this to happen, the container must be running in host network mode or have D-Bus socket forwarding and access to system network interfaces, which requires elevated privileges.