table of contents
NM-SETTINGS-NMCLI(5) | Configuration | NM-SETTINGS-NMCLI(5) |
NAME¶
nm-settings-nmcli - Description of settings and properties of NetworkManager connection profiles for nmcli
DESCRIPTION¶
NetworkManager is based on a concept of connection profiles, sometimes referred to as connections only. These connection profiles contain a network configuration. When NetworkManager activates a connection profile on a network device the configuration will be applied and an active network connection will be established. Users are free to create as many connection profiles as they see fit. Thus they are flexible in having various network configurations for different networking needs.
NetworkManager provides an API for configuring connection profiles, for activating them to configure the network, and inspecting the current network configuration. The command line tool nmcli is a client application to NetworkManager that uses this API. See nmcli(1) for details.
With commands like nmcli connection add, nmcli connection modify and nmcli connection show, connection profiles can be created, modified and inspected. A profile consists of properties. On D-Bus this follows the format as described by nm-settings-dbus(5), while this manual page describes the settings format how they are expected by nmcli.
The settings and properties shown in tables below list all available connection configuration options. However, note that not all settings are applicable to all connection types. nmcli connection editor has also a built-in describe command that can display description of particular settings and properties of this page.
The setting and property can be abbreviated provided they are unique. The list below also shows aliases that can be used unqualified instead of the full name. For example connection.interface-name and ifname refer to the same property.
connection setting¶
General Connection Profile Settings.
Properties:
connection.auth-retries
Currently, this only applies to 802-1x authentication.
Format: integer
Valid values: -1 - 2147483647
connection.autoconnect
Whether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection.
Autoconnect happens when the circumstances are suitable. That means for example that the device is currently managed and not active. Autoconnect thus never replaces or competes with an already active profile.
Note that autoconnect is not implemented for VPN profiles. See "secondaries" as an alternative to automatically connect VPN profiles.
If multiple profiles are ready to autoconnect on the same device, the one with the better "connection.autoconnect-priority" is chosen. If the priorities are equal, then the most recently connected profile is activated. If the profiles were not connected earlier or their "connection.timestamp" is identical, the choice is undefined.
Depending on "connection.multi-connect", a profile can (auto)connect only once at a time or multiple times.
Format: boolean
Valid values: true/yes/on, false/no/off
connection.autoconnect-ports
Format: choice (NMTernary)
Valid values: default (-1), false (0), true (1)
connection.autoconnect-priority
Format: integer
Valid values: -999 - 999
connection.autoconnect-retries
Format: integer
Valid values: -1 - 2147483647
Special values: default (-1), forever (0)
connection.autoconnect-slaves
Format: choice (NMSettingConnectionAutoconnectSlaves)
Valid values: default (-1), no (0), yes (1)
connection.controller
Interface name of the controller device or UUID of the controller connection.
Format: string
connection.dns-over-tls
The permitted values are: "yes" (2) use DNSOverTls and disabled fallback, "opportunistic" (1) use DNSOverTls but allow fallback to unencrypted resolution, "no" (0) don't ever use DNSOverTls. If unspecified "default" depends on the plugin used. Systemd-resolved uses global setting.
This feature requires a plugin which supports DNSOverTls. Otherwise, the setting has no effect. One such plugin is dns-systemd-resolved.
Format: choice (NMSettingConnectionDnsOverTls)
Valid values: default (-1), no (0), opportunistic (1), yes (2)
connection.gateway-ping-timeout
Format: integer
Valid values: 0 - 600
connection.id
A human readable unique identifier for the connection, like "Work Wi-Fi" or "T-Mobile 3G".
Format: string
connection.interface-name
The name of the network interface this connection is bound to. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings).
For software devices this specifies the name of the created device.
For connection types where interface names cannot easily be made persistent (e.g. mobile broadband or USB Ethernet), this property should not be used. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface.
Format: string
connection.lldp
Format: choice (NMSettingConnectionLldp)
Valid values: default (-1), disable (0), enable-rx/enable (1)
connection.llmnr
The permitted values are: "yes" (2) register hostname and resolving for the connection, "no" (0) disable LLMNR for the interface, "resolve" (1) do not register hostname but allow resolving of LLMNR host names If unspecified, "default" ultimately depends on the DNS plugin (which for systemd-resolved currently means "yes").
This feature requires a plugin which supports LLMNR. Otherwise, the setting has no effect. One such plugin is dns-systemd-resolved.
Format: choice (NMSettingConnectionLlmnr)
Valid values: default (-1), no (0), resolve (1), yes (2)
connection.master
Interface name of the master device or UUID of the master connection.
Deprecated 1.46. Use "controller" instead, this is just an alias.
Format: string
connection.mdns
The permitted values are: "yes" (2) register hostname and resolving for the connection, "no" (0) disable mDNS for the interface, "resolve" (1) do not register hostname but allow resolving of mDNS host names and "default" (-1) to allow lookup of a global default in NetworkManager.conf. If unspecified, "default" ultimately depends on the DNS plugin (which for systemd-resolved currently means "no").
This feature requires a plugin which supports mDNS. Otherwise, the setting has no effect. One such plugin is dns-systemd-resolved.
Format: choice (NMSettingConnectionMdns)
Valid values: default (-1), no (0), resolve (1), yes (2)
connection.metered
When updating this property on a currently activated connection, the change takes effect immediately.
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
connection.mptcp-flags
If "disabled" (0x1), MPTCP handling for the interface is disabled and no endpoints are registered.
The "enabled" (0x2) flag means that MPTCP handling is enabled. This flag can also be implied from the presence of other flags.
Even when enabled, MPTCP handling will by default still be disabled unless "/proc/sys/net/mptcp/enabled" sysctl is on. NetworkManager does not change the sysctl and this is up to the administrator or distribution. To configure endpoints even if the sysctl is disabled, "also-without-sysctl" (0x4) flag can be used. In that case, NetworkManager doesn't look at the sysctl and configures endpoints regardless.
Even when enabled, NetworkManager will only configure MPTCP endpoints for a certain address family, if there is a unicast default route (0.0.0.0/0 or ::/0) in the main routing table. The flag "also-without-default-route" (0x8) can override that.
When MPTCP handling is enabled then endpoints are configured with the specified address flags "signal" (0x10), "subflow" (0x20), "backup" (0x40), "fullmesh" (0x80). See ip-mptcp(8) manual for additional information about the flags.
If the flags are zero (0x0), the global connection default from NetworkManager.conf is honored. If still unspecified, the fallback is "enabled,subflow". Note that this means that MPTCP is by default done depending on the "/proc/sys/net/mptcp/enabled" sysctl.
NetworkManager does not change the MPTCP limits nor enable MPTCP via "/proc/sys/net/mptcp/enabled". That is a host configuration which the admin can change via sysctl and ip-mptcp.
Strict reverse path filtering (rp_filter) breaks many MPTCP use cases, so when MPTCP handling for IPv4 addresses on the interface is enabled, NetworkManager would loosen the strict reverse path filtering (1) to the loose setting (2).
Format: flags (NMMptcpFlags)
Valid values: none/default (0x0), disabled (0x1), enabled (0x2), also-without-sysctl (0x4), also-without-default-route (0x8), signal (0x10), subflow (0x20), backup (0x40), fullmesh (0x80)
connection.mud-url
The special value "none" is allowed to indicate that no MUD URL is used.
If the per-profile value is unspecified (the default), a global connection default gets consulted. If still unspecified, the ultimate default is "none".
Format: string
connection.multi-connect
Format: choice (NMConnectionMultiConnect)
Valid values: default (0), single (1), manual-multiple (2), multiple (3)
connection.permissions
At this time only the "user" [type] is allowed. Any other values are ignored and reserved for future use. [id] is the username that this permission refers to, which may not contain the ":" character. Any [reserved] information present must be ignored and is reserved for future use. All of [type], [id], and [reserved] must be valid UTF-8.
Format: list of strings
connection.port-type
Setting name of the device type of this port's controller connection (eg, "bond"), or NULL if this connection is not a port.
Format: string
Valid values: bond, bridge, ovs-bridge, ovs-port, team, vrf
connection.secondaries
Format: list of strings
connection.slave-type
Setting name of the device type of this slave's master connection (eg, "bond"), or NULL if this connection is not a slave.
Deprecated 1.46. Use "port-type" instead, this is just an alias.
Format: string
Valid values: bond, bridge, ovs-bridge, ovs-port, team, vrf
connection.stable-id
The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used to derive the DHCP client identifier with ipv4.dhcp-client-id=stable, the DHCPv6 DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid] and the DHCP IAID with ipv4.iaid=stable and ipv6.iaid=stable.
Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so that different interfaces yield different addresses. The per-host key is the identity of your machine and stored in /var/lib/NetworkManager/secret_key. See NetworkManager(8) manual about the secret-key and the host identity.
The '$' character is treated special to perform dynamic substitutions at activation time. Currently, supported are "${CONNECTION}", "${DEVICE}", "${MAC}", "${NETWORK_SSID}", "${BOOT}", "${RANDOM}". These effectively create unique IDs per-connection, per-device, per-SSID, per-boot, or every time. The "${CONNECTION}" uses the profile's connection.uuid, the "${DEVICE}" uses the interface name of the device and "${MAC}" the permanent MAC address of the device. "${NETWORK_SSID}" uses the SSID for Wi-Fi networks and falls back to "${CONNECTION}" on other networks. Any unrecognized patterns following '$' are treated verbatim, however are reserved for future use. You are thus advised to avoid '$' or escape it as "$$". For example, set it to "${CONNECTION}-${BOOT}-${DEVICE}" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates.
If the value is unset, a global connection default is consulted. If the value is still unset, the default is "default${CONNECTION}" go generate an ID unique per connection profile.
Format: string
connection.timestamp
NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp. The property is only meant for reading (changes to this property will not be preserved).
Format: read only
connection.type
Base type of the connection. For hardware-dependent connections, should contain the setting name of the hardware-type specific setting (ie, "802-3-ethernet" or "802-11-wireless" or "bluetooth", etc), and for non-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, "vpn" or "bridge", etc).
Format: string
Valid values: 6lowpan, 802-11-olpc-mesh, 802-11-wireless, 802-3-ethernet, adsl, bluetooth, bond, bridge, cdma, dummy, generic, gsm, hsr, infiniband, ip-tunnel, loopback, macsec, macvlan, ovs-bridge, ovs-dpdk, ovs-interface, ovs-patch, ovs-port, pppoe, team, tun, veth, vlan, vpn, vrf, vxlan, wifi-p2p, wimax, wireguard, wpan
connection.uuid
The UUID cannot be changed, except in offline mode. In that case, the special values "new", "generate" and "" are allowed to generate a new random UUID.
Format: string
connection.wait-activation-delay
The value 0 means no wait time. The default value is -1, which currently has the same meaning as no wait time.
Format: integer
Valid values: -1 - 2147483647
connection.wait-device-timeout
The value 0 means no wait time. The default value is -1, which currently has the same meaning as no wait time.
Format: integer
Valid values: -1 - 2147483647
connection.zone
When updating this property on a currently activated connection, the change takes effect immediately.
Format: string
6lowpan setting¶
6LoWPAN Settings.
Properties:
6lowpan.parent
If given, specifies the parent interface name or parent connection UUID from which this 6LowPAN interface should be created.
Format: string
802-1x setting¶
IEEE 802.1x Authentication Settings.
Properties:
802-1x.altsubject-matches
Format: list of strings
802-1x.anonymous-identity
Format: string
802-1x.auth-timeout
Format: integer
Valid values: 0 - 2147483647
802-1x.ca-cert
Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.
Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.
Format: filesystem path
802-1x.ca-cert-password
Format: string
802-1x.ca-cert-password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-1x.ca-path
If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored.
Format: string
802-1x.client-cert
Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte.
Format: filesystem path
802-1x.client-cert-password
Format: string
802-1x.client-cert-password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-1x.domain-match
Format: string
802-1x.domain-suffix-match
Format: string
802-1x.eap
Format: list of strings
Valid values: leap, md5, tls, peap, ttls, sim, fast, pwd
802-1x.identity
Format: string
802-1x.optional
Format: boolean
Valid values: true/yes/on, false/no/off
802-1x.pac-file
Format: string
802-1x.password
Format: string
802-1x.password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-1x.password-raw
Format: bytes
802-1x.password-raw-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-1x.phase1-auth-flags
Format: flags (NMSetting8021xAuthFlags)
Valid values: none (0x0), tls-1-0-disable (0x1), tls-1-1-disable (0x2), tls-1-2-disable (0x4), tls-disable-time-checks (0x8), tls-1-3-disable (0x10), tls-1-0-enable (0x20), tls-1-1-enable (0x40), tls-1-2-enable (0x80), tls-1-3-enable (0x100), all (0x1ff)
802-1x.phase1-fast-provisioning
Format: string
Valid values: 0, 1, 2, 3
802-1x.phase1-peaplabel
Format: string
Valid values: 0, 1
802-1x.phase1-peapver
Format: string
Valid values: 0, 1
802-1x.phase2-altsubject-matches
Format: list of strings
802-1x.phase2-auth
Format: string
Valid values: pap, chap, mschap, mschapv2, gtc, otp, md5, tls
802-1x.phase2-autheap
Format: string
Valid values: md5, mschapv2, otp, gtc, tls
802-1x.phase2-ca-cert
Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.
Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.
Format: filesystem path
802-1x.phase2-ca-cert-password
Format: string
802-1x.phase2-ca-cert-password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-1x.phase2-ca-path
If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored.
Format: filesystem path
802-1x.phase2-client-cert
Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.
Format: filesystem path
802-1x.phase2-client-cert-password
Format: string
802-1x.phase2-client-cert-password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-1x.phase2-domain-match
Format: string
802-1x.phase2-domain-suffix-match
Format: string
802-1x.phase2-private-key
Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2-private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "phase2-private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.
Format: filesystem path
802-1x.phase2-private-key-password
Format: string
802-1x.phase2-private-key-password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-1x.phase2-subject-match
This property is deprecated since version 1.2. Use "phase2-domain-suffix-match" instead.
Format: string
802-1x.pin
Format: string
802-1x.pin-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-1x.private-key
Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.
WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.
Format: filesystem path
802-1x.private-key-password
Format: string
802-1x.private-key-password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-1x.subject-match
This property is deprecated since version 1.2. Use "phase2-domain-suffix-match" instead.
Format: string
802-1x.system-ca-certs
Format: boolean
Valid values: true/yes/on, false/no/off
adsl setting¶
ADSL Settings.
Properties:
adsl.encapsulation
Encapsulation of ADSL connection. Can be "vcmux" or "llc".
Format: string
Valid values: vcmux, llc
adsl.password
Password used to authenticate with the ADSL service.
Format: string
adsl.password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
adsl.protocol
ADSL connection protocol. Can be "pppoa", "pppoe" or "ipoatm".
Format: string
Valid values: pppoa, pppoe, ipoatm
adsl.username
Username used to authenticate with the ADSL service.
Format: string
adsl.vci
Format: integer
Valid values: 0 - 65536
adsl.vpi
Format: integer
Valid values: 0 - 65536
bluetooth setting¶
Bluetooth Settings.
Properties:
bluetooth.bdaddr
The Bluetooth address of the device.
Format: MAC address
bluetooth.type
Either "dun" for Dial-Up Networking connections or "panu" for Personal Area Networking connections to devices supporting the NAP profile.
Format: string
Valid values: dun, panu, nap
bond setting¶
Bonding Settings.
Properties:
bond.options
Format: list of key/value options
bridge setting¶
Bridging Settings.
Properties:
bridge.ageing-time
The Ethernet MAC address aging time, in seconds.
Format: integer
Valid values: 0 - 1000000
bridge.forward-delay
The Spanning Tree Protocol (STP) forwarding delay, in seconds.
Format: integer
Valid values: 0 - 30
bridge.group-address
The address must be a link-local address in standard Ethernet MAC address format, ie an address of the form 01:80:C2:00:00:0X, with X in [0, 4..F]. If not specified the default value is 01:80:C2:00:00:00.
Format: MAC address
bridge.group-forward-mask
A mask of group addresses to forward. Usually, group addresses in the range from 01:80:C2:00:00:00 to 01:80:C2:00:00:0F are not forwarded according to standards. This property is a mask of 16 bits, each corresponding to a group address in that range that must be forwarded. The mask can't have bits 0, 1 or 2 set because they are used for STP, MAC pause frames and LACP.
Format: integer
Valid values: 0 - 65535
bridge.hello-time
The Spanning Tree Protocol (STP) hello time, in seconds.
Format: integer
Valid values: 0 - 10
bridge.mac-address
If specified, the MAC address of bridge. When creating a new bridge, this MAC address will be set.
If this field is left unspecified, the "ethernet.cloned-mac-address" is referred instead to generate the initial MAC address. Note that setting "ethernet.cloned-mac-address" anyway overwrites the MAC address of the bridge later while activating the bridge.
This property is deprecated since version 1.12. Use the "cloned-mac-address" property instead.
Format: MAC address
bridge.max-age
The Spanning Tree Protocol (STP) maximum message age, in seconds.
Format: integer
Valid values: 0 - 40
bridge.multicast-hash-max
Format: integer
Valid values: 1 - 4294967295
bridge.multicast-last-member-count
Format: integer
Valid values: 0 - 4294967295
bridge.multicast-last-member-interval
Format: integer
Valid values: 0 - 18446744073709551615
bridge.multicast-membership-interval
Format: integer
Valid values: 0 - 18446744073709551615
bridge.multicast-querier
Format: boolean
Valid values: true/yes/on, false/no/off
bridge.multicast-querier-interval
Format: integer
Valid values: 0 - 18446744073709551615
bridge.multicast-query-interval
Format: integer
Valid values: 0 - 18446744073709551615
bridge.multicast-query-response-interval
Format: integer
Valid values: 0 - 18446744073709551615
bridge.multicast-query-use-ifaddr
Format: boolean
Valid values: true/yes/on, false/no/off
bridge.multicast-router
Supported values are: 'auto', 'disabled', 'enabled' to which kernel assigns the numbers 1, 0, and 2, respectively. If not specified the default value is 'auto' (1).
Format: string
Valid values: auto, disabled, enabled
bridge.multicast-snooping
Controls whether IGMP snooping is enabled for this bridge. Note that if snooping was automatically disabled due to hash collisions, the system may refuse to enable the feature until the collisions are resolved.
Format: boolean
Valid values: true/yes/on, false/no/off
bridge.multicast-startup-query-count
Format: integer
Valid values: 0 - 4294967295
bridge.multicast-startup-query-interval
Format: integer
Valid values: 0 - 18446744073709551615
bridge.priority
Sets the Spanning Tree Protocol (STP) priority for this bridge. Lower values are "better"; the lowest priority bridge will be elected the root bridge.
Format: integer
Valid values: 0 - 65535
bridge.stp
Controls whether Spanning Tree Protocol (STP) is enabled for this bridge.
Format: boolean
Valid values: true/yes/on, false/no/off
bridge.vlan-default-pvid
Format: integer
Valid values: 0 - 4094
bridge.vlan-filtering
Format: boolean
Valid values: true/yes/on, false/no/off
bridge.vlan-protocol
Supported values are: '802.1Q', '802.1ad'. If not specified the default value is '802.1Q'.
Format: string
Valid values: 802.1Q, 802.1ad
bridge.vlan-stats-enabled
Format: boolean
Valid values: true/yes/on, false/no/off
bridge.vlans
In nmcli the VLAN list can be specified with the following syntax:
$vid [pvid] [untagged] [, $vid [pvid] [untagged]]...
where $vid is either a single id between 1 and 4094 or a range, represented as a couple of ids separated by a dash.
Format: list of bridge.vlans objects
bridge-port setting¶
Bridge Port Settings.
Properties:
bridge-port.hairpin-mode
Enables or disables "hairpin mode" for the port, which allows frames to be sent back out through the port the frame was received on.
Format: boolean
Valid values: true/yes/on, false/no/off
bridge-port.path-cost
The Spanning Tree Protocol (STP) port cost for destinations via this port.
Format: integer
Valid values: 0 - 65535
bridge-port.priority
The Spanning Tree Protocol (STP) priority of this bridge port.
Format: integer
Valid values: 0 - 63
bridge-port.vlans
In nmcli the VLAN list can be specified with the following syntax:
$vid [pvid] [untagged] [, $vid [pvid] [untagged]]...
where $vid is either a single id between 1 and 4094 or a range, represented as a couple of ids separated by a dash.
Format: list of bridge-port.vlans objects
cdma setting¶
CDMA-based Mobile Broadband Settings.
Properties:
cdma.mtu
Format: integer
Special values: auto
cdma.number
Format: string
cdma.password
The password used to authenticate with the network, if required. Many providers do not require a password, or accept any password. But if a password is required, it is specified here.
Format: string
cdma.password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
cdma.username
The username used to authenticate with the network, if required. Many providers do not require a username, or accept any username. But if a username is required, it is specified here.
Format: string
dcb setting¶
Data Center Bridging Settings.
Properties:
dcb.app-fcoe-flags
Format: flags (NMSettingDcbFlags)
Valid values: none (0x0), enable (0x1), advertise (0x2), willing (0x4)
dcb.app-fcoe-mode
Since 1.34, NULL is the default and means "fabric". Before 1.34, NULL was rejected as invalid and the default was "fabric".
Format: string
Valid values: fabric, vn2vn
dcb.app-fcoe-priority
Format: integer
Valid values: -1 - 7
Special values: unset (-1)
dcb.app-fip-flags
Format: flags (NMSettingDcbFlags)
Valid values: none (0x0), enable (0x1), advertise (0x2), willing (0x4)
dcb.app-fip-priority
Format: integer
Valid values: -1 - 7
Special values: unset (-1)
dcb.app-iscsi-flags
Format: flags (NMSettingDcbFlags)
Valid values: none (0x0), enable (0x1), advertise (0x2), willing (0x4)
dcb.app-iscsi-priority
Format: integer
Valid values: -1 - 7
Special values: unset (-1)
dcb.priority-bandwidth
Format: list of integers
Valid values: 0 - 100
dcb.priority-flow-control
Format: list of booleans
Valid values: true/yes/on, false/no/off
dcb.priority-flow-control-flags
Format: flags (NMSettingDcbFlags)
Valid values: none (0x0), enable (0x1), advertise (0x2), willing (0x4)
dcb.priority-group-bandwidth
Format: list of integers
Valid values: 0 - 100
dcb.priority-group-flags
Format: flags (NMSettingDcbFlags)
Valid values: none (0x0), enable (0x1), advertise (0x2), willing (0x4)
dcb.priority-group-id
Format: list of integers
Valid values: 0 - 7, 15
dcb.priority-strict-bandwidth
Format: list of booleans
Valid values: true/yes/on, false/no/off
dcb.priority-traffic-class
Format: list of integers
Valid values: 0 - 7
ethtool setting¶
Ethtool Ethernet Settings.
Properties:
ethtool.channels-combined
Valid values: 0 - 4294967295
ethtool.channels-other
Valid values: 0 - 4294967295
ethtool.channels-rx
Valid values: 0 - 4294967295
ethtool.channels-tx
Valid values: 0 - 4294967295
ethtool.coalesce-adaptive-rx
Valid values: 0 - 4294967295
ethtool.coalesce-adaptive-tx
Valid values: 0 - 4294967295
ethtool.coalesce-pkt-rate-high
Valid values: 0 - 4294967295
ethtool.coalesce-pkt-rate-low
Valid values: 0 - 4294967295
ethtool.coalesce-rx-frames
Valid values: 0 - 4294967295
ethtool.coalesce-rx-frames-high
Valid values: 0 - 4294967295
ethtool.coalesce-rx-frames-irq
Valid values: 0 - 4294967295
ethtool.coalesce-rx-frames-low
Valid values: 0 - 4294967295
ethtool.coalesce-rx-usecs
Valid values: 0 - 4294967295
ethtool.coalesce-rx-usecs-high
Valid values: 0 - 4294967295
ethtool.coalesce-rx-usecs-irq
Valid values: 0 - 4294967295
ethtool.coalesce-rx-usecs-low
Valid values: 0 - 4294967295
ethtool.coalesce-sample-interval
Valid values: 0 - 4294967295
ethtool.coalesce-stats-block-usecs
Valid values: 0 - 4294967295
ethtool.coalesce-tx-frames
Valid values: 0 - 4294967295
ethtool.coalesce-tx-frames-high
Valid values: 0 - 4294967295
ethtool.coalesce-tx-frames-irq
Valid values: 0 - 4294967295
ethtool.coalesce-tx-frames-low
Valid values: 0 - 4294967295
ethtool.coalesce-tx-usecs
Valid values: 0 - 4294967295
ethtool.coalesce-tx-usecs-high
Valid values: 0 - 4294967295
ethtool.coalesce-tx-usecs-irq
Valid values: 0 - 4294967295
ethtool.coalesce-tx-usecs-low
Valid values: 0 - 4294967295
ethtool.eee-enabled
Valid values: on, off, ignore
ethtool.feature-esp-hw-offload
Valid values: on, off, ignore
ethtool.feature-esp-tx-csum-hw-offload
Valid values: on, off, ignore
ethtool.feature-fcoe-mtu
Valid values: on, off, ignore
ethtool.feature-gro
Valid values: on, off, ignore
ethtool.feature-gso
Valid values: on, off, ignore
ethtool.feature-highdma
Valid values: on, off, ignore
ethtool.feature-hw-tc-offload
Valid values: on, off, ignore
ethtool.feature-l2-fwd-offload
Valid values: on, off, ignore
ethtool.feature-loopback
Valid values: on, off, ignore
ethtool.feature-lro
Valid values: on, off, ignore
ethtool.feature-macsec-hw-offload
Valid values: on, off, ignore
ethtool.feature-ntuple
Valid values: on, off, ignore
ethtool.feature-rx
Valid values: on, off, ignore
ethtool.feature-rx-all
Valid values: on, off, ignore
ethtool.feature-rx-fcs
Valid values: on, off, ignore
ethtool.feature-rx-gro-hw
Valid values: on, off, ignore
ethtool.feature-rx-gro-list
Valid values: on, off, ignore
ethtool.feature-rx-udp-gro-forwarding
Valid values: on, off, ignore
ethtool.feature-rx-udp_tunnel-port-offload
Valid values: on, off, ignore
ethtool.feature-rx-vlan-filter
Valid values: on, off, ignore
ethtool.feature-rx-vlan-stag-filter
Valid values: on, off, ignore
ethtool.feature-rx-vlan-stag-hw-parse
Valid values: on, off, ignore
ethtool.feature-rxhash
Valid values: on, off, ignore
ethtool.feature-rxvlan
Valid values: on, off, ignore
ethtool.feature-sg
Valid values: on, off, ignore
ethtool.feature-tls-hw-record
Valid values: on, off, ignore
ethtool.feature-tls-hw-rx-offload
Valid values: on, off, ignore
ethtool.feature-tls-hw-tx-offload
Valid values: on, off, ignore
ethtool.feature-tso
Valid values: on, off, ignore
ethtool.feature-tx
Valid values: on, off, ignore
ethtool.feature-tx-checksum-fcoe-crc
Valid values: on, off, ignore
ethtool.feature-tx-checksum-ip-generic
Valid values: on, off, ignore
ethtool.feature-tx-checksum-ipv4
Valid values: on, off, ignore
ethtool.feature-tx-checksum-ipv6
Valid values: on, off, ignore
ethtool.feature-tx-checksum-sctp
Valid values: on, off, ignore
ethtool.feature-tx-esp-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-fcoe-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-gre-csum-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-gre-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-gso-list
Valid values: on, off, ignore
ethtool.feature-tx-gso-partial
Valid values: on, off, ignore
ethtool.feature-tx-gso-robust
Valid values: on, off, ignore
ethtool.feature-tx-ipxip4-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-ipxip6-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-nocache-copy
Valid values: on, off, ignore
ethtool.feature-tx-scatter-gather
Valid values: on, off, ignore
ethtool.feature-tx-scatter-gather-fraglist
Valid values: on, off, ignore
ethtool.feature-tx-sctp-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-tcp-ecn-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-tcp-mangleid-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-tcp-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-tcp6-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-tunnel-remcsum-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-udp-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-udp_tnl-csum-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-udp_tnl-segmentation
Valid values: on, off, ignore
ethtool.feature-tx-vlan-stag-hw-insert
Valid values: on, off, ignore
ethtool.feature-txvlan
Valid values: on, off, ignore
ethtool.pause-autoneg
Valid values: on, off, ignore
ethtool.pause-rx
Valid values: on, off, ignore
ethtool.pause-tx
Valid values: on, off, ignore
ethtool.ring-rx
Valid values: 0 - 4294967295
ethtool.ring-rx-jumbo
Valid values: 0 - 4294967295
ethtool.ring-rx-mini
Valid values: 0 - 4294967295
ethtool.ring-tx
Valid values: 0 - 4294967295
generic setting¶
Generic Link Settings.
Properties:
generic.device-handler
See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.
By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.
Format: string
gsm setting¶
GSM-based Mobile Broadband Settings.
Properties:
gsm.apn
The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network. The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.
If the APN is unset (the default) then it may be detected based on "auto-config" setting. The property can be explicitly set to the empty string to prevent that and use no APN.
Format: string
gsm.auto-config
Format: boolean
Valid values: true/yes/on, false/no/off
gsm.device-id
Format: string
gsm.home-only
Format: boolean
Valid values: true/yes/on, false/no/off
gsm.initial-eps-bearer-apn
Format: string
gsm.initial-eps-bearer-configure
Format: boolean
Valid values: true/yes/on, false/no/off
gsm.mtu
Format: integer
Special values: auto
gsm.network-id
Format: string
gsm.number
This property is deprecated since version 1.16. User-provided values for this setting are no longer used.
Format: string
gsm.password
The password used to authenticate with the network, if required. Many providers do not require a password, or accept any password. But if a password is required, it is specified here.
Format: string
gsm.password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
gsm.pin
Format: string
gsm.pin-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
gsm.sim-id
Format: string
gsm.sim-operator-id
Format: string
gsm.username
The username used to authenticate with the network, if required. Many providers do not require a username, or accept any username. But if a username is required, it is specified here.
Format: string
infiniband setting¶
Infiniband Settings.
Properties:
infiniband.mac-address
If specified, this connection will only apply to the IPoIB device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).
Format: Infiniband MAC address
infiniband.mtu
If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames.
Format: integer
Special values: auto
infiniband.p-key
The InfiniBand p-key to use for this device. A value of -1 means to use the default p-key (aka "the p-key at index 0"). Otherwise, it is a 16-bit unsigned integer, whose high bit 0x8000 is set if it is a "full membership" p-key. The values 0 and 0x8000 are not allowed.
With the p-key set, the interface name is always "$parent.$p_key". Setting "connection.interface-name" to another name is not supported.
Note that kernel will internally always set the full membership bit, although the interface name does not reflect that. Usually the user would want to configure a full membership p-key with 0x8000 flag set.
Format: integer
Valid values: -1 - 65535
Special values: default (-1)
infiniband.parent
The interface name of the parent device of this device. Normally NULL, but if the "p_key" property is set, then you must specify the base device by setting either this property or "mac-address".
Format: string
infiniband.transport-mode
The IP-over-InfiniBand transport mode. Either "datagram" or "connected".
Format: string
Valid values: datagram, connected
ipv4 setting¶
IPv4 Settings.
Properties:
ipv4.addresses
A list of IPv4 addresses and their prefix length. Multiple addresses can be separated by comma. For example "192.168.1.5/24, 10.1.0.5/24". The addresses are listed in decreasing priority, meaning the first address will be the primary address.
Format: list of ipv4.addresses objects
ipv4.auto-route-ext-gw
For other connection types, adding such an automatic route is currently not supported and setting this to TRUE has no effect.
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
ipv4.dad-timeout
A zero value means that no duplicate address detection is performed, -1 means the default value (either the value configured globally in NetworkManger.conf or zero). A value greater than zero is a timeout in milliseconds. Note that the time intervals are subject to randomization as per RFC 5227 and so the actual duration can be between half and the full time specified in this property.
Format: integer
Valid values: -1 - 30000
Special values: default (-1), off (0)
ipv4.dhcp-client-id
The special values "mac" and "perm-mac" are supported, which use the current or permanent MAC address of the device to generate a client identifier with type ethernet (01). Currently, these options only work for ethernet type of links.
The special value "ipv6-duid" uses the DUID from "ipv6.dhcp-duid" property as an RFC4361-compliant client identifier. As IAID it uses "ipv4.dhcp-iaid" and falls back to "ipv6.dhcp-iaid" if unset.
The special value "duid" generates a RFC4361-compliant client identifier based on "ipv4.dhcp-iaid" and uses a DUID generated by hashing /etc/machine-id.
The special value "stable" is supported to generate a type 0 client identifier based on the stable-id (see connection.stable-id) and a per-host key. If you set the stable-id, you may want to include the "${DEVICE}" or "${MAC}" specifier to get a per-device key.
The special value "none" prevents any client identifier from being sent. Note that this is normally not recommended.
If unset, a globally configured default from NetworkManager.conf is used. If still unset, the default depends on the DHCP plugin. The internal dhcp client will default to "mac" and the dhclient plugin will try to use one from its config file if present, or won't sent any client-id otherwise.
Format: string
Special values: mac, perm-mac, duid, ipv6-duid, stable, none
ipv4.dhcp-dscp
The property is currently valid only for IPv4, and it is supported only by the "internal" DHCP plugin.
Format: string
Valid values: CS0, CS4, CS6
ipv4.dhcp-fqdn
Format: string
ipv4.dhcp-hostname
Format: string
ipv4.dhcp-hostname-flags
Currently, this property only includes flags to control the FQDN flags set in the DHCP FQDN option. Supported FQDN flags are "fqdn-serv-update" (0x1), "fqdn-encoded" (0x2) and "fqdn-no-update" (0x4). When no FQDN flag is set and "fqdn-clear-flags" (0x8) is set, the DHCP FQDN option will contain no flag. Otherwise, if no FQDN flag is set and "fqdn-clear-flags" (0x8) is not set, the standard FQDN flags are set in the request: "fqdn-serv-update" (0x1), "fqdn-encoded" (0x2) for IPv4 and "fqdn-serv-update" (0x1) for IPv6.
When this property is set to the default value "none" (0x0), a global default is looked up in NetworkManager configuration. If that value is unset or also "none" (0x0), then the standard FQDN flags described above are sent in the DHCP requests.
Format: flags (NMDhcpHostnameFlags)
Valid values: none (0x0), fqdn-serv-update (0x1), fqdn-encoded (0x2), fqdn-no-update (0x4), fqdn-clear-flags (0x8)
ipv4.dhcp-iaid
For DHCPv4, the IAID is only used with "ipv4.dhcp-client-id" values "duid" and "ipv6-duid" to generate the client-id.
For DHCPv6, note that at the moment this property is only supported by the "internal" DHCPv6 plugin. The "dhclient" DHCPv6 plugin always derives the IAID from the MAC address.
The actually used DHCPv6 IAID for a currently activated interface is exposed in the lease information of the device.
Format: string
ipv4.dhcp-reject-servers
For DHCPv4, each element must be an IPv4 address, optionally followed by a slash and a prefix length (e.g. "192.168.122.0/24").
This property is currently not implemented for DHCPv6.
Format: list of IPv4 addresses
ipv4.dhcp-send-hostname
Format: boolean
Valid values: true/yes/on, false/no/off
ipv4.dhcp-timeout
Set to 2147483647 (MAXINT32) for infinity.
Format: integer
Valid values: 0 - 2147483647
Special values: default (0), infinity (2147483647)
ipv4.dhcp-vendor-class-identifier
Format: string
ipv4.dns
For DoT (DNS over TLS), the SNI server name can be specified by appending "#example.com" to the IP address of the DNS server. This currently only has effect when using systemd-resolved.
Format: list of IPv4 addresses
ipv4.dns-options
The currently supported options are "attempts", "debug", "edns0", "ndots", "no-aaaa", "no-check-names", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc". See the resolv.conf(5) manual.
Note that there is a distinction between an unset (default) list and an empty list. In nmcli, to unset the list set the value to "". To set an empty list, set it to " ". Currently, an unset list has the same meaning as an empty list. That might change in the future.
The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.
When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.
The valid "ipv4.dns-options" and "ipv6.dns-options" get merged together.
Format: list of strings
ipv4.dns-priority
The relative priority for DNS servers specified by this setting. A lower numerical value is better (higher priority).
Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles.
Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections.
Note that the priority is to order DNS settings for multiple active connections. It does not disambiguate multiple DNS servers within the same connection profile.
When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.
When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the "rotate" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered.
When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain. Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually). When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins. If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.
Format: integer
Valid values: -2147483648 - 2147483647
ipv4.dns-search
When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting.
When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting "ignore-auto-dns". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).
Format: list of strings
ipv4.gateway
The gateway associated with this configuration. This is only meaningful if "addresses" is also set.
Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if "never-default" is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length.
Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See "ip4-auto-default-route".
Format: IPv4 address
ipv4.ignore-auto-dns
Format: boolean
Valid values: true/yes/on, false/no/off
ipv4.ignore-auto-routes
Format: boolean
Valid values: true/yes/on, false/no/off
ipv4.link-local
When set to "auto", the value is dependent on "ipv4.method". When set to "default", it honors the global connection default, before falling back to "auto". Note that if "ipv4.method" is "disabled", then link local addressing is always disabled too. The default is "default".
Format: choice (NMSettingIP4LinkLocal)
Valid values: default (0), auto (1), disabled (2), enabled (3)
ipv4.may-fail
Format: boolean
Valid values: true/yes/on, false/no/off
ipv4.method
Format: string
Valid values: auto, link-local, manual, shared, disabled
ipv4.never-default
Format: boolean
Valid values: true/yes/on, false/no/off
ipv4.replace-local-rule
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
ipv4.required-timeout
This property is useful for example if both IPv4 and IPv6 are enabled and are allowed to fail. Normally the connection succeeds as soon as one of the two address families completes; by setting a required timeout for e.g. IPv4, one can ensure that even if IP6 succeeds earlier than IPv4, NetworkManager waits some time for IPv4 before the connection becomes active.
Note that if "may-fail" is FALSE for the same address family, this property has no effect as NetworkManager needs to wait for the full DHCP timeout.
A zero value means that no required timeout is present, -1 means the default value (either configuration ipvx.required-timeout override or zero).
Format: integer
Valid values: -1 - 2147483647
Special values: default (-1), infinity (2147483647)
ipv4.route-metric
Format: integer
Valid values: -1 - 4294967295
ipv4.route-table
This affects all routes, including device-routes, IPv4LL, DHCP, SLAAC, default-routes and static routes. But note that static routes can individually overwrite the setting by explicitly specifying a non-zero routing table.
If the table setting is left at zero, it is eligible to be overwritten via global configuration. If the property is zero even after applying the global configuration value, policy routing is disabled for the address family of this connection.
Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table). Additionally, NetworkManager will not delete any extraneous routes from tables except the main table. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager.
Format: integer
Valid values: 0 - 4294967295
Special values: unspec (0), main (254)
ipv4.routes
Various attributes are supported:
Note that in NetworkManager, currently all nexthops of a ECMP route must share the same "onlink" flag in order to be mergable.
For details see also `man ip-route`.
Format: list of ipv4.routes objects
ipv4.routing-rules
Example: priority 5 from 192.167.4.0/24 table 45
Format: list of ipv4.routing-rules objects
ipv6 setting¶
IPv6 Settings.
Properties:
ipv6.addr-gen-mode
The permitted values are: "eui64" (0), "stable-privacy" (1), "default" (3) or "default-or-eui64" (2).
If the property is set to "eui64", the addresses will be generated using the interface token derived from hardware address. This makes the host part of the address to stay constant, making it possible to track the host's presence when it changes networks. The address changes when the interface hardware is replaced. If a duplicate address is detected, there is also no fallback to generate another address. When configured, the "ipv6.token" is used instead of the MAC address to generate addresses for stateless autoconfiguration.
If the property is set to "stable-privacy", the interface identifier is generated as specified by RFC7217. This works by hashing a host specific key (see NetworkManager(8) manual), the interface name, the connection's "connection.stable-id" property and the address prefix. This improves privacy by making it harder to use the address to track the host's presence and the address is stable when the network interface hardware is replaced.
The special values "default" and "default-or-eui64" will fallback to the global connection default as documented in the NetworkManager.conf(5) manual. If the global default is not specified, the fallback value is "stable-privacy" or "eui64", respectively.
If not specified, when creating a new profile the default is "default".
Note that this setting is distinct from the Privacy Extensions as configured by "ip6-privacy" property and it does not affect the temporary addresses configured with this option.
Format: choice (NMSettingIP6ConfigAddrGenMode)
Valid values: eui64 (0), stable-privacy (1), default-or-eui64 (2), default (3)
ipv6.addresses
A list of IPv6 addresses and their prefix length. Multiple addresses can be separated by comma. For example "2001:db8:85a3::8a2e:370:7334/64, 2001:db8:85a3::5/64". The addresses are listed in decreasing priority, meaning the first address will be the primary address. This can make a difference with IPv6 source address selection (RFC 6724, section 5).
Format: list of ipv6.addresses objects
ipv6.auto-route-ext-gw
For other connection types, adding such an automatic route is currently not supported and setting this to TRUE has no effect.
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
ipv6.dhcp-duid
The special value "lease" will retrieve the DUID previously used from the lease file belonging to the connection. If no DUID is found and "dhclient" is the configured dhcp client, the DUID is searched in the system-wide dhclient lease file. If still no DUID is found, or another dhcp client is used, a global and permanent DUID-UUID (RFC 6355) will be generated based on the machine-id.
The special values "llt" and "ll" will generate a DUID of type LLT or LL (see RFC 3315) based on the current MAC address of the device. In order to try providing a stable DUID-LLT, the time field will contain a constant timestamp that is used globally (for all profiles) and persisted to disk.
The special values "stable-llt", "stable-ll" and "stable-uuid" will generate a DUID of the corresponding type, derived from the connection's stable-id and a per-host unique key. You may want to include the "${DEVICE}" or "${MAC}" specifier in the stable-id, in case this profile gets activated on multiple devices. So, the link-layer address of "stable-ll" and "stable-llt" will be a generated address derived from the stable id. The DUID-LLT time value in the "stable-llt" option will be picked among a static timespan of three years (the upper bound of the interval is the same constant timestamp used in "llt").
When the property is unset, the global value provided for "ipv6.dhcp-duid" is used. If no global value is provided, the default "lease" value is assumed.
Format: string
ipv6.dhcp-hostname
Format: string
ipv6.dhcp-hostname-flags
Currently, this property only includes flags to control the FQDN flags set in the DHCP FQDN option. Supported FQDN flags are "fqdn-serv-update" (0x1), "fqdn-encoded" (0x2) and "fqdn-no-update" (0x4). When no FQDN flag is set and "fqdn-clear-flags" (0x8) is set, the DHCP FQDN option will contain no flag. Otherwise, if no FQDN flag is set and "fqdn-clear-flags" (0x8) is not set, the standard FQDN flags are set in the request: "fqdn-serv-update" (0x1), "fqdn-encoded" (0x2) for IPv4 and "fqdn-serv-update" (0x1) for IPv6.
When this property is set to the default value "none" (0x0), a global default is looked up in NetworkManager configuration. If that value is unset or also "none" (0x0), then the standard FQDN flags described above are sent in the DHCP requests.
Format: flags (NMDhcpHostnameFlags)
Valid values: none (0x0), fqdn-serv-update (0x1), fqdn-encoded (0x2), fqdn-no-update (0x4), fqdn-clear-flags (0x8)
ipv6.dhcp-iaid
For DHCPv4, the IAID is only used with "ipv4.dhcp-client-id" values "duid" and "ipv6-duid" to generate the client-id.
For DHCPv6, note that at the moment this property is only supported by the "internal" DHCPv6 plugin. The "dhclient" DHCPv6 plugin always derives the IAID from the MAC address.
The actually used DHCPv6 IAID for a currently activated interface is exposed in the lease information of the device.
Format: string
ipv6.dhcp-pd-hint
Format: string
ipv6.dhcp-send-hostname
Format: boolean
Valid values: true/yes/on, false/no/off
ipv6.dhcp-timeout
Set to 2147483647 (MAXINT32) for infinity.
Format: integer
Valid values: 0 - 2147483647
Special values: default (0), infinity (2147483647)
ipv6.dns
For DoT (DNS over TLS), the SNI server name can be specified by appending "#example.com" to the IP address of the DNS server. This currently only has effect when using systemd-resolved.
Format: list of IPv6 addresses
ipv6.dns-options
The currently supported options are "attempts", "debug", "edns0", "ndots", "no-aaaa", "no-check-names", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc" and "inet6", "ip6-bytestring", "ip6-dotint", "no-ip6-dotint". See the resolv.conf(5) manual.
Note that there is a distinction between an unset (default) list and an empty list. In nmcli, to unset the list set the value to "". To set an empty list, set it to " ". Currently, an unset list has the same meaning as an empty list. That might change in the future.
The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.
When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.
The valid "ipv4.dns-options" and "ipv6.dns-options" get merged together.
Format: list of strings
ipv6.dns-priority
The relative priority for DNS servers specified by this setting. A lower numerical value is better (higher priority).
Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles.
Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections.
Note that the priority is to order DNS settings for multiple active connections. It does not disambiguate multiple DNS servers within the same connection profile.
When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.
When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the "rotate" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered.
When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain. Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually). When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins. If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.
Format: integer
Valid values: -2147483648 - 2147483647
ipv6.dns-search
When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting.
When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting "ignore-auto-dns". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).
Format: list of strings
ipv6.gateway
The gateway associated with this configuration. This is only meaningful if "addresses" is also set.
Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if "never-default" is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length.
Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See "ip4-auto-default-route".
Format: IPv6 address
ipv6.ignore-auto-dns
Format: boolean
Valid values: true/yes/on, false/no/off
ipv6.ignore-auto-routes
Format: boolean
Valid values: true/yes/on, false/no/off
ipv6.ip6-privacy
Having a per-connection setting set to "-1" (unknown) means fallback to global configuration "ipv6.ip6-privacy".
If also global configuration is unspecified or set to "-1", fallback to read "/proc/sys/net/ipv6/conf/default/use_tempaddr".
Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the "addr-gen-mode" property's "stable-privacy" setting as another way of avoiding host tracking with IPv6 addresses.
Format: choice (NMSettingIP6ConfigPrivacy)
Valid values: unknown (-1), disabled (0), prefer-public-addr (1), prefer-temp-addr (2)
ipv6.may-fail
Format: boolean
Valid values: true/yes/on, false/no/off
ipv6.method
If you set "auto", "dhcp", "manual", "ignore", or "shared", NetworkManager assigns, in addition to the global address, an IPv6 link-local address to the interface. This is compliant with RFC 4291.
Format: string
Valid values: ignore, auto, dhcp, link-local, manual, shared, disabled
ipv6.mtu
Format: integer
Special values: auto
ipv6.never-default
Format: boolean
Valid values: true/yes/on, false/no/off
ipv6.ra-timeout
Set to 2147483647 (MAXINT32) for infinity.
Format: integer
Valid values: 0 - 2147483647
Special values: default (0), infinity (2147483647)
ipv6.replace-local-rule
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
ipv6.required-timeout
This property is useful for example if both IPv4 and IPv6 are enabled and are allowed to fail. Normally the connection succeeds as soon as one of the two address families completes; by setting a required timeout for e.g. IPv4, one can ensure that even if IP6 succeeds earlier than IPv4, NetworkManager waits some time for IPv4 before the connection becomes active.
Note that if "may-fail" is FALSE for the same address family, this property has no effect as NetworkManager needs to wait for the full DHCP timeout.
A zero value means that no required timeout is present, -1 means the default value (either configuration ipvx.required-timeout override or zero).
Format: integer
Valid values: -1 - 2147483647
Special values: default (-1), infinity (2147483647)
ipv6.route-metric
Format: integer
Valid values: -1 - 4294967295
ipv6.route-table
This affects all routes, including device-routes, IPv4LL, DHCP, SLAAC, default-routes and static routes. But note that static routes can individually overwrite the setting by explicitly specifying a non-zero routing table.
If the table setting is left at zero, it is eligible to be overwritten via global configuration. If the property is zero even after applying the global configuration value, policy routing is disabled for the address family of this connection.
Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table). Additionally, NetworkManager will not delete any extraneous routes from tables except the main table. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager.
Format: integer
Valid values: 0 - 4294967295
Special values: unspec (0), main (254)
ipv6.routes
Various attributes are supported:
For details see also `man ip-route`.
Format: list of ipv6.routes objects
ipv6.routing-rules
Example: priority 5 from 1:2:3::5/128 table 45
Format: list of ipv6.routing-rules objects
ipv6.token
When set, the token is used as IPv6 interface identifier instead of the hardware address. This only applies to addresses from stateless autoconfiguration, not to IPv6 link local addresses.
Format: string
ip-tunnel setting¶
IP Tunneling Settings.
Properties:
ip-tunnel.encapsulation-limit
Format: integer
Valid values: 0 - 255
ip-tunnel.flags
Format: flags (NMIPTunnelFlags)
Valid values: none (0x0), ip6-ign-encap-limit (0x1), ip6-use-orig-tclass (0x2), ip6-use-orig-flowlabel (0x4), ip6-mip6-dev (0x8), ip6-rcv-dscp-copy (0x10), ip6-use-orig-fwmark (0x20)
ip-tunnel.flow-label
Format: integer
Valid values: 0 - 1048575
ip-tunnel.fwmark
Format: integer
Valid values: 0 - 4294967295
ip-tunnel.input-key
Format: string
ip-tunnel.local
The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.
Format: string
ip-tunnel.mode
The tunneling mode. Valid values: ipip (1), gre (2), sit (3), isatap (4), vti (5), ip6ip6 (6), ipip6 (7), ip6gre (8), vti6 (9), gretap (10) and ip6gretap (11)
Format: choice (NMIPTunnelMode)
Valid values: ipip (1), gre (2), sit (3), isatap (4), vti (5), ip6ip6 (6), ipip6 (7), ip6gre (8), vti6 (9), gretap (10), ip6gretap (11)
ip-tunnel.mtu
Format: integer
Special values: auto
ip-tunnel.output-key
Format: string
ip-tunnel.parent
If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.
Format: string
ip-tunnel.path-mtu-discovery
Format: boolean
Valid values: true/yes/on, false/no/off
ip-tunnel.remote
The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.
Format: string
ip-tunnel.tos
Format: integer
Valid values: 0 - 255
ip-tunnel.ttl
Format: integer
Valid values: 0 - 255
macsec setting¶
MACSec Settings.
Properties:
macsec.encrypt
Whether the transmitted traffic must be encrypted.
Format: boolean
Valid values: true/yes/on, false/no/off
macsec.mka-cak
The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.
Format: string
macsec.mka-cak-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
macsec.mka-ckn
The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.
Format: string
macsec.mode
Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.
Format: choice (NMSettingMacsecMode)
Valid values: psk (0), eap (1)
macsec.offload
"off" (0) disables MACsec offload.
"phy" (1) and "mac" (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.
"default" (-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is "off" (0).
Format: choice (NMSettingMacsecOffload)
Valid values: default (-1), off (0), phy (1), mac (2)
macsec.parent
If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created. If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.
Format: string
macsec.port
The port component of the SCI (Secure Channel Identifier), between 1 and 65534.
Format: integer
Valid values: 1 - 65534
macsec.send-sci
Format: boolean
Valid values: true/yes/on, false/no/off
macsec.validation
Format: choice (NMSettingMacsecValidation)
Valid values: disable (0), check (1), strict (2)
macvlan setting¶
MAC VLAN Settings.
Properties:
macvlan.mode
The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.
Format: choice (NMSettingMacvlanMode)
Valid values: vepa (1), bridge (2), private (3), passthru (4), source (5)
macvlan.parent
If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created. If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.
Format: string
macvlan.promiscuous
Format: boolean
Valid values: true/yes/on, false/no/off
macvlan.tap
Whether the interface should be a MACVTAP.
Format: boolean
Valid values: true/yes/on, false/no/off
match setting¶
Match settings.
Properties:
match.driver
See NMSettingMatch:interface-name for how special characters '|', '&', '!' and '\\' are used for optional and mandatory matches and inverting the pattern.
Format: list of strings
match.interface-name
An element can be prefixed with a pipe symbol (|) or an ampersand (&). The former means that the element is optional and the latter means that it is mandatory. If there are any optional elements, than the match evaluates to true if at least one of the optional element matches (logical OR). If there are any mandatory elements, then they all must match (logical AND). By default, an element is optional. This means that an element "foo" behaves the same as "|foo". An element can also be inverted with exclamation mark (!) between the pipe symbol (or the ampersand) and before the pattern. Note that "!foo" is a shortcut for the mandatory match "&!foo". Finally, a backslash can be used at the beginning of the element (after the optional special characters) to escape the start of the pattern. For example, "&\\!a" is an mandatory match for literally "!a".
Format: list of strings
match.kernel-command-line
See NMSettingMatch:interface-name for how special characters '|', '&', '!' and '\\' are used for optional and mandatory matches and inverting the match.
Format: list of strings
match.path
For PCI devices the path has the form "pci-$domain:$bus:$device.$function", where each variable is an hexadecimal value; for example "pci-0000:0a:00.0".
The path of a device can be obtained with "udevadm info /sys/class/net/$dev | grep ID_PATH=" or by looking at the "path" property exported by NetworkManager ("nmcli -f general.path device show $dev").
Each element of the list is a shell wildcard pattern.
See NMSettingMatch:interface-name for how special characters '|', '&', '!' and '\\' are used for optional and mandatory matches and inverting the pattern.
Format: list of strings
802-11-olpc-mesh setting¶
Alias: olpc-mesh
OLPC Wireless Mesh Settings.
Properties:
802-11-olpc-mesh.channel
Channel on which the mesh network to join is located.
Format: integer
Valid values: 0 - 4294967295
802-11-olpc-mesh.dhcp-anycast-address
Anycast DHCP MAC address used when requesting an IP address via DHCP. The specific anycast address used determines which DHCP server class answers the request.
This is currently only implemented by dhclient DHCP plugin.
Format: MAC address
802-11-olpc-mesh.ssid
SSID of the mesh network to join.
Format: string
ovs-bridge setting¶
OvsBridge Link Settings.
Properties:
ovs-bridge.datapath-type
Format: string
Valid values: system, netdev
ovs-bridge.fail-mode
Format: string
Valid values: secure, standalone
ovs-bridge.mcast-snooping-enable
Format: boolean
Valid values: true/yes/on, false/no/off
ovs-bridge.rstp-enable
Format: boolean
Valid values: true/yes/on, false/no/off
ovs-bridge.stp-enable
Format: boolean
Valid values: true/yes/on, false/no/off
ovs-dpdk setting¶
OvsDpdk Link Settings.
Properties:
ovs-dpdk.devargs
Format: string
ovs-dpdk.n-rxq
Format: integer
Valid values: 0 - 4294967295
ovs-dpdk.n-rxq-desc
Format: integer
Valid values: 0 - 4096
ovs-dpdk.n-txq-desc
Format: integer
Valid values: 0 - 4096
ovs-interface setting¶
Open vSwitch Interface Settings.
Properties:
ovs-interface.ofport-request
Format: integer
Valid values: 0 - 65279
ovs-interface.type
Format: string
Valid values: internal, system, patch, dpdk
ovs-patch setting¶
OvsPatch Link Settings.
Properties:
ovs-patch.peer
Format: string
ovs-port setting¶
OvsPort Link Settings.
Properties:
ovs-port.bond-downdelay
Format: integer
Valid values: 0 - 4294967295
ovs-port.bond-mode
Format: string
Valid values: active-backup, balance-slb, balance-tcp
ovs-port.bond-updelay
Format: integer
Valid values: 0 - 4294967295
ovs-port.lacp
Format: string
Valid values: active, off, passive
ovs-port.tag
Format: integer
Valid values: 0 - 4095
ovs-port.trunks
The property is valid only for ports with mode "trunk", "native-tagged", or "native-untagged port". If it is empty, the port trunks all VLANs.
Format: list of ovs-port.trunks objects
ovs-port.vlan-mode
Format: string
Valid values: access, native-tagged, native-untagged, trunk, dot1q-tunnel
ppp setting¶
Point-to-Point Protocol Settings.
Properties:
ppp.baud
Format: integer
Valid values: 0 - 4294967295
ppp.crtscts
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.lcp-echo-failure
Format: integer
Valid values: 0 - 4294967295
ppp.lcp-echo-interval
Format: integer
Valid values: 0 - 4294967295
ppp.mppe-stateful
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.mru
Format: integer
Valid values: 0 - 16384
ppp.mtu
Format: integer
Special values: auto
ppp.no-vj-comp
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.noauth
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.nobsdcomp
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.nodeflate
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.refuse-chap
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.refuse-eap
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.refuse-mschap
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.refuse-mschapv2
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.refuse-pap
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.require-mppe
Format: boolean
Valid values: true/yes/on, false/no/off
ppp.require-mppe-128
Format: boolean
Valid values: true/yes/on, false/no/off
pppoe setting¶
PPP-over-Ethernet Settings.
Properties:
pppoe.parent
If given, specifies the parent interface name on which this PPPoE connection should be created. If this property is not specified, the connection is activated on the interface specified in "interface-name" of NMSettingConnection.
Format: string
pppoe.password
Password used to authenticate with the PPPoE service.
Format: string
pppoe.password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
pppoe.service
If specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service. For most providers, this should be left blank. It is only required if there are multiple access concentrators or a specific service is known to be required.
Format: string
pppoe.username
Username used to authenticate with the PPPoE service.
Format: string
proxy setting¶
WWW Proxy Settings.
Properties:
proxy.browser-only
Whether the proxy configuration is for browser only.
Format: boolean
Valid values: true/yes/on, false/no/off
proxy.method
Method for proxy configuration, Default is "none" (0)
Format: choice (NMSettingProxyMethod)
Valid values: none (0), auto (1)
proxy.pac-script
The PAC script. In the profile this must be an UTF-8 encoded javascript code that defines a FindProxyForURL() function. When setting the property in nmcli, a filename is accepted too. In that case, nmcli will read the content of the file and set the script. The prefixes "file://" and "js://" are supported to explicitly differentiate between the two.
Format: string
proxy.pac-url
PAC URL for obtaining PAC file.
Format: string
serial setting¶
Serial Link Settings.
Properties:
serial.baud
Format: integer
Valid values: 0 - 4294967295
serial.bits
Format: integer
Valid values: 5 - 8
serial.parity
Format: choice (NMSettingSerialParity)
Valid values: none/N/n (0), even/E/e (1), odd/O/o (2)
serial.send-delay
Format: integer
Valid values: 0 - 18446744073709551615
serial.stopbits
Format: integer
Valid values: 1 - 2
sriov setting¶
SR-IOV settings.
Properties:
sriov.autoprobe-drivers
If set to "true" (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF.
If set to "false" (0), VFs will not be claimed and no network interfaces will be created for them.
When set to "default" (-1), the global default is used; in case the global default is unspecified it is assumed to be "true" (1).
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
sriov.eswitch-encap-mode
Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
If set to "preserve" (-1) (default) the eswitch encap-mode won't be modified by NetworkManager.
Format: choice (NMSriovEswitchEncapMode)
Valid values: preserve (-1), none (0), basic (1)
sriov.eswitch-inline-mode
Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
If set to "preserve" (-1) (default) the eswitch inline-mode won't be modified by NetworkManager.
Format: choice (NMSriovEswitchInlineMode)
Valid values: preserve (-1), none (0), link (1), network (2), transport (3)
sriov.eswitch-mode
If set to "preserve" (-1) (default) the eswitch mode won't be modified by NetworkManager.
Format: choice (NMSriovEswitchMode)
Valid values: preserve (-1), legacy (0), switchdev (1)
sriov.total-vfs
Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.
Format: integer
Valid values: 0 - 4294967295
sriov.vfs
Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF.
When represented as string a VF is in the form:
"INDEX [ATTR=VALUE[ ATTR=VALUE]...]".
for example:
"2 mac=00:11:22:33:44:55 spoof-check=true".
Multiple VFs can be specified using a comma as separator. Currently, the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans.
The "vlans" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form
"ID[.PRIORITY[.PROTO]]".
PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.
Format: list of sriov.vfs objects
tc setting¶
Linux Traffic Control Settings.
Properties:
tc.qdiscs
Each qdisc can be specified by the following attributes:
handle HANDLE
parent HANDLE
root
KIND
Parameters for 'fq_codel':
limit U32
memory_limit U32
flows U32
target U32
interval U32
quantum U32
ecn BOOL
ce_threshold U32
Parameters for 'sfq':
divisor U32
limit U32
depth U32
perturb_period U32
quantum U32
flows U32
Parameters for 'tbf':
rate U64
burst U32
If your buffer is too small, packets may be dropped because more tokens arrive per timer tick than fit in your bucket. The minimum buffer size can be calculated by dividing the rate by HZ.
Token usage calculations are performed using a table which by default has a resolution of 8 packets. This resolution can be changed by specifying the cell size with the burst. For example, to specify a 6000 byte buffer with a 16 byte cell size, set a burst of 6000/16. You will probably never have to set this. Must be an integral power of 2.
limit U32
latency U32
Format: list of tc.qdiscs objects
tc.tfilters
Each tfilters can be specified by the following attributes:
handle HANDLE
parent HANDLE
root
KIND
Actions for 'mirred':
egress bool
ingress bool
mirror bool
redirect bool
Action for 'simple':
sdata char[32]
Format: list of tc.tfilters objects
team setting¶
Teaming Settings.
Properties:
team.config
The JSON configuration for the team network interface. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details.
Format: string
team.link-watchers
Format: list of team.link-watchers objects
team.mcast-rejoin-count
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), disabled (0)
team.mcast-rejoin-interval
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), default (0)
team.notify-peers-count
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), disabled (0)
team.notify-peers-interval
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), default (0)
team.runner
Format: string
Valid values: broadcast, roundrobin, random, activebackup, loadbalance, lacp
team.runner-active
Format: boolean
Valid values: true/yes/on, false/no/off
team.runner-agg-select-policy
Format: string
Valid values: lacp_prio, lacp_prio_stable, bandwidth, count, port_config
team.runner-fast-rate
Format: boolean
Valid values: true/yes/on, false/no/off
team.runner-hwaddr-policy
Format: string
Valid values: same_all, by_active, only_active
team.runner-min-ports
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), default (1)
team.runner-sys-prio
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), default (65535)
team.runner-tx-balancer
Format: string
Valid values: basic
team.runner-tx-balancer-interval
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), default (50)
team.runner-tx-hash
Format: list of strings
Valid values: eth, vlan, ipv4, ipv6, ip, l3, tcp, udp, sctp, l4
team-port setting¶
Team Port Settings.
Properties:
team-port.config
The JSON configuration for the team port. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details.
Format: string
team-port.lacp-key
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), default (0)
team-port.lacp-prio
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), default (255)
team-port.link-watchers
Format: list of team-port.link-watchers objects
team-port.prio
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (0), default (0)
team-port.queue-id
Format: integer
Valid values: -2147483648 - 2147483647
Special values: unset (-1), default (0)
team-port.sticky
Format: boolean
Valid values: true/yes/on, false/no/off
tun setting¶
Tunnel Settings.
Properties:
tun.group
The group ID which will own the device. If set to NULL everyone will be able to use the device.
Format: string
tun.mode
The operating mode of the virtual device. Allowed values are "tun" (1) to create a layer 3 device and "tap" (2) to create an Ethernet-like layer 2 one.
Format: choice (NMSettingTunMode)
Valid values: tun (1), tap (2)
tun.multi-queue
If the property is set to TRUE, the interface will support multiple file descriptors (queues) to parallelize packet sending or receiving. Otherwise, the interface will only support a single queue.
Format: boolean
Valid values: true/yes/on, false/no/off
tun.owner
The user ID which will own the device. If set to NULL everyone will be able to use the device.
Format: string
tun.pi
If TRUE the interface will prepend a 4 byte header describing the physical interface to the packets.
Format: boolean
Valid values: true/yes/on, false/no/off
tun.vnet-hdr
If TRUE the IFF_VNET_HDR the tunnel packets will include a virtio network header.
Format: boolean
Valid values: true/yes/on, false/no/off
vlan setting¶
VLAN Settings.
Properties:
vlan.egress-priority-map
For outgoing packets, a list of mappings from Linux SKB priorities to 802.1p priorities. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3".
Format: list of vlan.egress-priority-map objects
vlan.flags
One or more flags which control the behavior and features of the VLAN interface. Flags include "reorder-headers" (0x1) (reordering of output packet headers), "gvrp" (0x2) (use of the GVRP protocol), and "loose-binding" (0x4) (loose binding of the interface to its master device's operating state). "mvrp" (0x8) (use of the MVRP protocol).
The default value of this property is NM_VLAN_FLAG_REORDER_HEADERS, but it used to be 0. To preserve backward compatibility, the default-value in the D-Bus API continues to be 0 and a missing property on D-Bus is still considered as 0.
Format: flags (NMVlanFlags)
Valid values: reorder-headers (0x1), gvrp (0x2), loose-binding (0x4), mvrp (0x8)
vlan.id
The VLAN identifier that the interface created by this connection should be assigned. The valid range is from 0 to 4094, without the reserved id 4095.
Format: integer
Valid values: 0 - 4095
vlan.ingress-priority-map
For incoming packets, a list of mappings from 802.1p priorities to Linux SKB priorities. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3".
Format: list of vlan.ingress-priority-map objects
vlan.parent
If given, specifies the parent interface name or parent connection UUID from which this VLAN interface should be created. If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.
Format: string
vlan.protocol
Supported values are: '802.1Q', '802.1ad'. If not specified the default value is '802.1Q'.
Format: string
Valid values: 802.1Q, 802.1ad
vpn setting¶
VPN Settings.
Properties:
vpn.data
Format: list of key/value options
vpn.persistent
Format: boolean
Valid values: true/yes/on, false/no/off
vpn.secrets
Format: list of key/value options
vpn.service-type
D-Bus service name of the VPN plugin that this setting uses to connect to its network. i.e. org.freedesktop.NetworkManager.vpnc for the vpnc plugin.
Format: string
vpn.timeout
Format: integer
Valid values: 0 - 4294967295
vpn.user-name
If the VPN connection requires a user name for authentication, that name should be provided here. If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty. If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection.
Format: string
vrf setting¶
VRF settings.
Properties:
vrf.table
The routing table for this VRF.
Format: integer
Valid values: 0 - 4294967295
vxlan setting¶
VXLAN Settings.
Properties:
vxlan.ageing
Format: integer
Valid values: 0 - 4294967295
vxlan.destination-port
Specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint.
Format: integer
Valid values: 0 - 65535
vxlan.id
Specifies the VXLAN Network Identifier (or VXLAN Segment Identifier) to use.
Format: integer
Valid values: 0 - 16777215
vxlan.l2-miss
Format: boolean
Valid values: true/yes/on, false/no/off
vxlan.l3-miss
Format: boolean
Valid values: true/yes/on, false/no/off
vxlan.learning
Format: boolean
Valid values: true/yes/on, false/no/off
vxlan.limit
Format: integer
Valid values: 0 - 4294967295
vxlan.local
If given, specifies the source IP address to use in outgoing packets.
Format: string
vxlan.parent
If given, specifies the parent interface name or parent connection UUID.
Format: string
vxlan.proxy
Format: boolean
Valid values: true/yes/on, false/no/off
vxlan.remote
Specifies the unicast destination IP address to use in outgoing packets when the destination link layer address is not known in the VXLAN device forwarding database, or the multicast IP address to join.
Format: string
vxlan.rsc
Format: boolean
Valid values: true/yes/on, false/no/off
vxlan.source-port-max
Specifies the maximum UDP source port to communicate to the remote VXLAN tunnel endpoint.
Format: integer
Valid values: 0 - 65535
vxlan.source-port-min
Specifies the minimum UDP source port to communicate to the remote VXLAN tunnel endpoint.
Format: integer
Valid values: 0 - 65535
vxlan.tos
Format: integer
Valid values: 0 - 255
vxlan.ttl
Format: integer
Valid values: 0 - 255
wifi-p2p setting¶
Wi-Fi P2P Settings.
Properties:
wifi-p2p.peer
The P2P device that should be connected to. Currently, this is the only way to create or join a group.
Format: MAC address
wifi-p2p.wfd-ies
Wi-Fi Display requires a protocol specific information element to be set in certain Wi-Fi frames. These can be specified here for the purpose of establishing a connection. This setting is only useful when implementing a Wi-Fi Display client.
Format: bytes
wifi-p2p.wps-method
There's little point in changing the default setting as NetworkManager will automatically determine the best method to use.
Format: flags (NMSettingWirelessSecurityWpsMethod)
Valid values: default (0x0), disabled (0x1), auto (0x2), pbc (0x4), pin (0x8)
wimax setting¶
WiMax Settings.
Properties:
wimax.mac-address
If specified, this connection will only apply to the WiMAX device whose MAC address matches. This property does not change the MAC address of the device (known as MAC spoofing).
This property is deprecated since version 1.2. WiMAX is no longer supported.
Format: string
wimax.network-name
Network Service Provider (NSP) name of the WiMAX network this connection should use.
This property is deprecated since version 1.2. WiMAX is no longer supported.
Format: MAC address
802-3-ethernet setting¶
Alias: ethernet
Wired Ethernet Settings.
Properties:
802-3-ethernet.accept-all-mac-addresses
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
802-3-ethernet.auto-negotiate
Format: boolean
Valid values: true/yes/on, false/no/off
802-3-ethernet.cloned-mac-address
If specified, request that the device use this MAC address instead. This is known as MAC cloning or spoofing.
Beside explicitly specifying a MAC address, the special values "preserve", "permanent", "random" and "stable" are supported. "preserve" means not to touch the MAC address on activation. "permanent" means to use the permanent hardware address if the device has one (otherwise this is treated as "preserve"). "random" creates a random MAC address on each connect. "stable" creates a hashed MAC address based on connection.stable-id and a machine dependent key.
If unspecified, the value can be overwritten via global defaults, see manual of NetworkManager.conf. If still unspecified, it defaults to "preserve" (older versions of NetworkManager may use a different default value).
On D-Bus, this field is expressed as "assigned-mac-address" or the deprecated "cloned-mac-address".
Format: MAC address
Special values: preserve, permanent, random, stable
802-3-ethernet.duplex
Format: string
Valid values: half, full
802-3-ethernet.generate-mac-address-mask
If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address.
If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm.
If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally-administered, burned-in MAC address.
If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered.
Format: string
802-3-ethernet.mac-address
If specified, this connection will only apply to the Ethernet device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).
Format: MAC address
802-3-ethernet.mac-address-blacklist
Format: list of MAC addresses
802-3-ethernet.mtu
If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.
Format: integer
Special values: auto
802-3-ethernet.port
Format: read only
802-3-ethernet.s390-nettype
Format: string
Valid values: qeth, lcs, ctc
802-3-ethernet.s390-options
Currently, NetworkManager itself does nothing with this information. However, s390utils ships a udev rule which parses this information and applies it to the interface.
Format: list of key/value options
802-3-ethernet.s390-subchannels
Format: list of 802-3-ethernet.s390-subchannels objects
802-3-ethernet.speed
Format: integer
Valid values: 0 - 4294967295
802-3-ethernet.wake-on-lan
Format: flags (NMSettingWiredWakeOnLan)
Valid values: phy (0x2), unicast (0x4), multicast (0x8), broadcast (0x10), arp (0x20), magic (0x40), default (0x1), ignore (0x8000)
802-3-ethernet.wake-on-lan-password
Format: MAC address
wireguard setting¶
WireGuard Settings.
Properties:
wireguard.fwmark
Note that "ip4-auto-default-route" or "ip6-auto-default-route" enabled, implies to automatically choose a fwmark.
Format: integer
Valid values: 0 - 4294967295
wireguard.ip4-auto-default-route
Note that for this automatism to work, you usually don't want to set ipv4.gateway, because that will result in a conflicting default route.
Leaving this at the default will enable this option automatically if ipv4.never-default is not set and there are any peers that use a default-route as allowed-ips. Since this automatism only makes sense if you also have a peer with an /0 allowed-ips, it is usually not necessary to enable this explicitly. However, you can disable it if you want to configure your own routing and rules.
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
wireguard.ip6-auto-default-route
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
wireguard.listen-port
Format: integer
Valid values: 0 - 65535
wireguard.mtu
If zero a default MTU is used. Note that contrary to wg-quick's MTU setting, this does not take into account the current routes at the time of activation.
Format: integer
Special values: auto
wireguard.peer-routes
Note that if the peer's AllowedIPs is "0.0.0.0/0" or "::/0" and the profile's ipv4.never-default or ipv6.never-default setting is enabled, the peer route for this peer won't be added automatically.
Format: boolean
Valid values: true/yes/on, false/no/off
wireguard.private-key
Format: string
wireguard.private-key-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-11-wireless setting¶
Alias: wifi
Wi-Fi Settings.
Properties:
802-11-wireless.ap-isolation
If set to "true" (1), devices are not able to communicate with each other. This increases security because it protects devices against attacks from other clients in the network. At the same time, it prevents devices to access resources on the same wireless networks as file shares, printers, etc.
If set to "false" (0), devices can talk to each other.
When set to "default" (-1), the global default is used; in case the global default is unspecified it is assumed to be "false" (0).
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
802-11-wireless.band
Format: string
Valid values: a, bg
802-11-wireless.bssid
Locking a client profile to a certain BSSID will prevent roaming and also disable background scanning. That can be useful, if there is only one access point for the SSID.
Format: MAC address
802-11-wireless.channel
Format: integer
Valid values: 0 - 4294967295
802-11-wireless.cloned-mac-address
If specified, request that the device use this MAC address instead. This is known as MAC cloning or spoofing.
Beside explicitly specifying a MAC address, the special values "preserve", "permanent", "random", "stable" and "stable-ssid" are supported. "preserve" means not to touch the MAC address on activation. "permanent" means to use the permanent hardware address of the device. "random" creates a random MAC address on each connect. "stable" creates a hashed MAC address based on connection.stable-id and a machine dependent key. "stable-ssid" creates a hashed MAC address based on the SSID, the same as setting the stable-id to "${NETWORK_SSID}".
If unspecified, the value can be overwritten via global defaults, see manual of NetworkManager.conf. If still unspecified, it defaults to "preserve" (older versions of NetworkManager may use a different default value).
On D-Bus, this field is expressed as "assigned-mac-address" or the deprecated "cloned-mac-address".
Format: MAC address
Special values: preserve, permanent, random, stable, stable-ssid
802-11-wireless.generate-mac-address-mask
If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address.
If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm.
If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally-administered, burned-in MAC address.
If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered.
Format: string
802-11-wireless.hidden
In infrastructure mode, various workarounds are used for a more reliable discovery of hidden networks, such as probe-scanning the SSID. However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution.
In AP mode, the created network does not broadcast its SSID.
Note that marking the network as hidden may be a privacy issue for you (in infrastructure mode) or client stations (in AP mode), as the explicit probe-scans are distinctly recognizable on the air.
Format: boolean
Valid values: true/yes/on, false/no/off
802-11-wireless.mac-address
If specified, this connection will only apply to the Wi-Fi device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).
Format: MAC address
802-11-wireless.mac-address-blacklist
Format: list of MAC addresses
802-11-wireless.mac-address-randomization
This property is deprecated since version 1.4. Use the "cloned-mac-address" property instead.
Format: choice (NMSettingMacRandomization)
Valid values: default (0), never (1), always (2)
802-11-wireless.mode
Wi-Fi network mode; one of "infrastructure", "mesh", "adhoc" or "ap". If blank, infrastructure is assumed.
Format: string
Valid values: infrastructure, adhoc, ap, mesh
802-11-wireless.mtu
If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.
Format: integer
Special values: auto
802-11-wireless.powersave
Format: choice (NMSettingWirelessPowersave)
Valid values: default (0), ignore (1), disable (2), enable (3)
802-11-wireless.seen-bssids
This is not a regular property that the user would configure. Instead, NetworkManager automatically sets the seen BSSIDs and tracks them internally in "/var/lib/NetworkManager/seen-bssids" file.
Format: read only
802-11-wireless.ssid
SSID of the Wi-Fi network. Must be specified.
Format: string
802-11-wireless.wake-on-wlan
Format: flags (NMSettingWirelessWakeOnWLan)
Valid values: any (0x2), disconnect (0x4), magic (0x8), gtk-rekey-failure (0x10), eap-identity-request (0x20), 4way-handshake (0x40), rfkill-release (0x80), tcp (0x100), all (0x1fe), default (0x1), ignore (0x8000)
802-11-wireless-security setting¶
Alias: wifi-sec
Wi-Fi Security Settings.
Properties:
802-11-wireless-security.auth-alg
Format: string
Valid values: open, shared, leap
802-11-wireless-security.fils
Format: choice (NMSettingWirelessSecurityFils)
Valid values: default (0), disable (1), optional (2), required (3)
802-11-wireless-security.group
Format: list of strings
Valid values: wep40, wep104, tkip, ccmp
802-11-wireless-security.key-mgmt
This property must be set for any Wi-Fi connection that uses security.
Format: string
Valid values: none, ieee8021x, wpa-psk, wpa-eap, wpa-eap-suite-b-192, sae, owe
802-11-wireless-security.leap-password
Format: string
802-11-wireless-security.leap-password-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-11-wireless-security.leap-username
Format: string
802-11-wireless-security.pairwise
Format: list of strings
Valid values: tkip, ccmp
802-11-wireless-security.pmf
Format: choice (NMSettingWirelessSecurityPmf)
Valid values: default (0), disable (1), optional (2), required (3)
802-11-wireless-security.proto
Format: list of strings
Valid values: wpa, rsn
802-11-wireless-security.psk
Format: string
802-11-wireless-security.psk-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-11-wireless-security.wep-key-flags
Format: flags (NMSettingSecretFlags)
Valid values: none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)
802-11-wireless-security.wep-key-type
Format: choice (NMWepKeyType)
Valid values: unknown (0), key (1), passphrase (2)
802-11-wireless-security.wep-key0
Format: string
802-11-wireless-security.wep-key1
Format: string
802-11-wireless-security.wep-key2
Format: string
802-11-wireless-security.wep-key3
Format: string
802-11-wireless-security.wep-tx-keyidx
Format: integer
Valid values: 0 - 3
802-11-wireless-security.wps-method
There's little point in changing the default setting as NetworkManager will automatically determine whether it's feasible to start WPS enrollment from the Access Point capabilities.
WPS can be disabled by setting this property to a value of 1.
Format: flags (NMSettingWirelessSecurityWpsMethod)
Valid values: default (0x0), disabled (0x1), auto (0x2), pbc (0x4), pin (0x8)
wpan setting¶
IEEE 802.15.4 (WPAN) MAC Settings.
Properties:
wpan.channel
IEEE 802.15.4 channel. A positive integer or -1, meaning "do not set, use whatever the device is already set to".
Format: integer
Valid values: -32768 - 32767
Special values: default (-1)
wpan.mac-address
If specified, this connection will only apply to the IEEE 802.15.4 (WPAN) MAC layer device whose permanent MAC address matches.
Format: WPAN MAC address
wpan.page
IEEE 802.15.4 channel page. A positive integer or -1, meaning "do not set, use whatever the device is already set to".
Format: integer
Valid values: -32768 - 32767
Special values: default (-1)
wpan.pan-id
IEEE 802.15.4 Personal Area Network (PAN) identifier.
Format: integer
Valid values: 0 - 65535
Special values: unset (0xffff)
wpan.short-address
Short IEEE 802.15.4 address to be used within a restricted environment.
Format: integer
Valid values: 0 - 65535
Special values: unset (0xffff)
bond-port setting¶
Bond Port Settings.
Properties:
bond-port.prio
The port priority for bond active port re-selection during failover. A higher number means a higher priority in selection. The primary port has the highest priority. This option is only compatible with active-backup, balance-tlb and balance-alb modes.
Format: integer
Valid values: -2147483648 - 2147483647
bond-port.queue-id
The queue ID of this bond port. The maximum value of queue ID is the number of TX queues currently active in device.
Format: integer
Valid values: 0 - 65535
hostname setting¶
Hostname settings.
Properties:
hostname.from-dhcp
When set to "default" (-1), the value from global configuration is used. If the property doesn't have a value in the global configuration, NetworkManager assumes the value to be "true" (1).
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
hostname.from-dns-lookup
When set to "default" (-1), the value from global configuration is used. If the property doesn't have a value in the global configuration, NetworkManager assumes the value to be "true" (1).
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
hostname.only-from-default
If set to "false" (0), the hostname can be set from this device even if it doesn't have the default route.
When set to "default" (-1), the value from global configuration is used. If the property doesn't have a value in the global configuration, NetworkManager assumes the value to be "false" (0).
Format: ternary
Valid values: true/yes/on, false/no/off, default/unknown
hostname.priority
If the value is zero, it can be overridden by a global value from NetworkManager configuration. If the property doesn't have a value in the global configuration, the value is assumed to be 100.
Negative values have the special effect of excluding other connections with a greater numerical priority value; so in presence of at least one negative priority, only connections with the lowest priority value will be used to determine the hostname.
Format: integer
Valid values: -2147483648 - 2147483647
hsr setting¶
HSR/PRP Settings.
Properties:
hsr.multicast-spec
The last byte of supervision address.
Format: integer
Valid values: 0 - 255
hsr.port1
The port1 interface name of the HSR. This property is mandatory.
Format: string
hsr.port2
The port2 interface name of the HSR. This property is mandatory.
Format: string
hsr.prp
Format: boolean
Valid values: true/yes/on, false/no/off
link setting¶
Link settings.
Properties:
link.gro-max-size
Format: integer
Valid values: -1 - 4294967295
Special values: default (-1)
link.gso-max-segments
Format: integer
Valid values: -1 - 4294967295
Special values: default (-1)
link.gso-max-size
Format: integer
Valid values: -1 - 4294967295
Special values: default (-1)
link.tx-queue-length
Format: integer
Valid values: -1 - 4294967295
Special values: default (-1)
loopback setting¶
Loopback Link Settings.
Properties:
loopback.mtu
If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.
Format: integer
Special values: auto
veth setting¶
Veth Settings.
Properties:
veth.peer
This property specifies the peer interface name of the veth. This property is mandatory.
Format: string
Secret flag types:¶
Each password or secret property in a setting has an associated flags property that describes how to handle that secret. The flags property is a bitfield that contains zero or more of the following values logically OR-ed together.
FILES¶
/etc/NetworkManager/system-connections or distro plugin-specific location
SEE ALSO¶
nmcli(1), nmcli-examples(7), NetworkManager(8), nm-settings-dbus(5), nm-settings-keyfile(5), NetworkManager.conf(5)
NetworkManager 1.46.0 |