109.2 Lesson 2

Most Linux distributions adopt the NetworkManager service daemon to configure and control the system’s network connections. NetworkManager’s purpose is to make the network configuration as simple and automatic as possible. When using DHCP, for example, NetworkManager arranges route changes, IP address fetching and updates to the local list of DNS servers, if necessary. When both wired and wireless connections are available, NetworkManager prioritizes the wired connection by default. NetworkManager will try to keep at least one connection active all the time, whenever it is possible.

By default, the NetworkManager daemon controls the network interfaces not mentioned in the /etc/network/interfaces file. It does so to not interfere with other configuration methods that may be present as well, thus modifying the unattended interfaces only.

The NetworkManager service runs in the background with root privileges and triggers the necessary actions to keep the system online. Ordinary users can create and modify network connections with client applications that, albeit not having root privileges themselves, are capable of communicating with the underlying service in order to perform the requested actions.

Client applications for NetworkManager are available for both the command line and the graphical environment. For the latter, the client application comes as an accessory of the desktop environment (under names like, nm-tray, network-manager-gnome, nm-applet or plasma-nm) and it is usually accessible through an indicator icon at the corner of the desktop bar or from the system configuration utility.

In the command line, NetworkManager itself provides two client programs: nmcli and nmtui. Both programs have the same basic features, but nmtui has a curses-based interface while nmcli is a more comprehensive command that can also be used in scripts. Command nmcli separates all network related properties controlled by NetworkManager in categories called objects:

The object name is the main argument to command nmcli. To show the overall connectivity status of the system, for example, the object general should be given as the argument:

Column STATE tells whether the system is connected to a network or not. If the connection is limited due to external misconfiguration or access restrictions, then the CONNECTIVITY column will not report the full connectivity status. If Portal appears in the CONNECTIVITY column, it means that extra authentication steps (usually through the web browser) are required to complete the connection process. The remaining columns report the status of the wireless connections (if any), either WIFI or WWAN (Wide Wireless Area Network, i.e. cellular networks). The HW suffix indicates that the status corresponds to the network device rather than the system network connection, that is, it tells if the hardware is enabled or disabled to save power.

In addition to the object argument, nmcli also needs a command argument to execute. The status command is used by default if no command argument is present, so the command nmcli general is actually interpreted as nmcli general status.

It is hardly necessary to take any action when the network adapter is connected directly to the access point through cables, but wireless networks require further interaction to accept new members. nmcli facilitates the connection process and saves the settings to connect automatically in the future, hence it is very helpful for laptops or any other mobile appliances.

Before connecting to wi-fi, it is convenient to first list the available networks in the local area. If the system has a working wi-fi adapter, then the device object will use it to scan the available networks with command nmcli device wifi list:

Most users will probably use the name in the SSID column to identify the network of interest. For example, command nmcli can connect to the network named Hypnotoad using the device object again:

If the command is executed inside a terminal emulator in the graphical environment, then a dialog box will appear asking for the network’s passphrase. When executed in a text only console, the password may be provided together with the other arguments:

If the wi-fi network hides its SSID name, nmcli can still connect to it with the extra hidden yes arguments:

If the system has more than one wi-fi adapter, the one to be used may be indicated with ifname. For example, to connect using the adapter named wlo1:

After the connection succeeds, NetworkManager will name it after the corresponding SSID (if it is a wi-fi connection) and will keep it for future connections. The connections names and their UUIDs are listed by command nmcli connection show:

The type of each connection is shown — which can be ethernet, wifi, tun, gsm, bridge, etc. — as well as the device to which they are associated with. To perform actions on a specific connection, its name or UUID must be supplied. To deactivate the Hypnotoad connection, for example:

Likewise, the command nmcli connection up Hypnotoad can be used to bring the connection up, as it is now saved by NetworkManager. The interface name can also be used to reconnect, but in this case the device object should be used instead:

The interface name can also be used to reestablish the connection:

Note that the connection UUID changes every time the connection is brought up, so it is preferable to use its name for consistency.

If the wireless adapter is available but it is not being used, then it can be turned off to save power. This time, the object radio should be passed to nmcli:

Of course, the wireless device can be turned on again with command nmcli radio wifi on.

Once the connections are established no manual interaction will be required in the future, as NetworkManager identifies available known networks and automatically connects to them. If necessary, NetworkManager has plugins that can extend its functionalities, like the plugin to support VPN connections.

Systems running systemd can optionally use its built-in daemons to manage network connectivity: systemd-networkd to control network interfaces and systemd-resolved to manage the local name resolution. These services are backwards compatible with legacy Linux configuration methods, but the configuration of network interfaces in particular has features that are worth knowing.

The configuration files used by systemd-networkd to setup network interfaces can be found in any of the following three directories:

The files are processed in lexicographic order, so it is recommended to start their names with numbers to make the ordering easier to read and set.

Files in /etc have the highest priority, whilst files in /run take precedence over files with the same name in /lib. This means that if configuration files in different directories have the same name, then systemd-networkd will ignore the files with lesser priority. Separating files like that is a way to change the interface settings without having to modify the original files: modifications can be placed in /etc/systemd/network to override those in /lib/systemd/network.

The purpose of each configuration file depends on its suffix. File names ending in .netdev are used by systemd-networkd to create virtual network devices, such as bridge or tun devices. Files ending in .link set low-level configurations for the corresponding network interface. systemd-networkd detects and configures network devices automatically as they appear — as well as ignore devices already configured by other means — so there is little need to add these files in most situations.

The most important suffix is .network. Files using this suffix can be used to setup network addresses and routes. As with the other configuration file types, the name of the file defines the order in which the file will be processed. The network interface to which the configuration file refers to is defined in the [Match]` section inside the file.

For example, the ethernet network interface enp3s5 can be selected within the file /etc/systemd/network/30-lan.network by using the Name=enp3s5 entry in the [Match] section:

A list of whitespace-separated names is also accepted to match many network interfaces with this same file at once. The names can contain shell-style globs, like en*. Other entries provide various matching rules, like selecting a network device by its MAC address:

The settings for the device are in the [Network] section of the file. A simple static network configuration only requires the Address and Gateway entries:

To use the DHCP protocol instead of static IP addresses, the DHCP entry should be used instead:

The systemd-networkd service will try to fetch both IPv4 and IPv6 addresses for the network interface. To use IPv4 only, DHCP=ipv4 should be used. Likewise, DHCP=ipv6 will ignore IPv4 settings and use the provided IPv6 address only.

Password-protected wireless networks can also be configured by systemd-networkd, but the network adapter must be already authenticated in the network before systemd-networkd can configure it. Authentication is performed by WPA supplicant, a program dedicated to configure network adapters for password protected networks.

The first step is to create the credentials file with command wpa_passphrase:

This command will take the passphrase for the MyWifi wireless network from the standard input and store its hash in the /etc/wpa_supplicant/wpa_supplicant-wlo1.conf. Note that the filename should contain the appropriate name of the wireless interface, hence the wlo1 in the file name.

The systemd manager reads the WPA passphrase files in /etc/wpa_supplicant/ and creates the corresponding service to run WPA supplicant and bring the interface up. The passphrase file created in the example will then have a corresponding service unit called wpa_supplicant@wlo1.service. Command systemctl start wpa_supplicant@wlo1.service will associate the wireless adapter with the remote access point. Command systemctl enable wpa_supplicant@wlo1.service makes the association automatic during boot time.

Finally, a .network file matching the wlo1 interface must be present in /etc/systemd/network/, as systemd-networkd will use it to configure the interface as soon as WPA supplicant finishes the association with the access point.