Network ConfigurationLesson 2 of 3

Static IPv4 and IPv6 with nmcli

Give a connection a fixed address, gateway and DNS for IPv4 and IPv6, make it persistent, and read the keyfile NetworkManager writes.

nmcli connection modify
nmcli connection add
nmcli connection up
nmcli connection reload
nmtui
/etc/NetworkManager/system-connections
ipv4.method manual
ipv6.addresses

50 min6 exercises

After this lesson you can

Set a static IPv4 address, gateway, DNS server and search domain on an existing connection and apply it.
Add a static IPv6 address, a second address on the same interface, and a new connection for a second NIC.
Locate the keyfile that stores a connection, check its permissions, and return a connection to DHCP.

The idea

On RHEL 10 the persistent way to configure networking is NetworkManager, driven by nmcli (command line), nmtui (text menus) or the web console. Settings are stored per connection in keyfiles: /etc/NetworkManager/system-connections/NAME.nmconnection. The old ifcfg-* files under /etc/sysconfig/network-scripts/ are no longer how RHEL 10 works, so do not edit them.

Changing the configuration is always the same two moves:

nmcli connection modify NAME property value ...: edit the saved settings (written to the keyfile at once).
nmcli connection up NAME: apply the settings to the live device.

modify alone changes the file and not the running network; up without modify re-applies the old one. The settings are persistent because they are in the file, and they apply at boot because connection.autoconnect is yes.

The properties you need

Property	Example	Meaning
`ipv4.method`	`manual` / `auto` / `disabled`	Static / DHCP / off
`ipv4.addresses`	`192.168.122.50/24`	Address and prefix length, comma-separated list
`ipv4.gateway`	`192.168.122.1`	Default gateway
`ipv4.dns`	`192.168.122.1`	DNS servers (comma-separated)
`ipv4.dns-search`	`lab.example`	Domain appended to short names
`ipv6.*`	`ipv6.addresses fd00:122::50/64`	The same properties for IPv6
`connection.autoconnect`	`yes`	Bring up at boot

Notes:

With ipv4.method manual you must supply an address; nmcli refuses a method change without one.
+ipv4.addresses ADDR appends and -ipv4.addresses ADDR removes one entry; plain ipv4.addresses ADDR replaces the list.
Quote connection names with spaces: "System eth0".
The same thing for IPv6 uses ipv6.method manual; leave it at auto to keep SLAAC/DHCPv6, or disabled to turn it off.

Try it

sudo nmcli connection modify "System eth0" \
    ipv4.method manual \
    ipv4.addresses 192.168.122.50/24 \
    ipv4.gateway 192.168.122.1 \
    ipv4.dns 192.168.122.1 \
    ipv4.dns-search lab.example \
    connection.autoconnect yes
sudo nmcli connection up "System eth0"

Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)

ip -br addr show eth0
ip route | head -2
cat /etc/resolv.conf

eth0             UP             192.168.122.50/24
default via 192.168.122.1 dev eth0 proto static metric 100
192.168.122.0/24 dev eth0 proto kernel scope link src 192.168.122.50 metric 100
# Generated by NetworkManager
search lab.example
nameserver 192.168.122.1

/etc/resolv.conf is generated by NetworkManager from the connection. Edit the connection, not the file, or your change is overwritten the next time the connection comes up.

IPv6 and a second address

sudo nmcli connection modify "System eth0" \
    ipv6.method manual \
    ipv6.addresses fd00:122::50/64 \
    ipv6.gateway fd00:122::1 \
    ipv6.dns fd00:122::1
sudo nmcli connection up "System eth0"
ip -6 addr show dev eth0 scope global

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fd00:122::50/64 scope global noprefixroute
       valid_lft forever preferred_lft forever

sudo nmcli connection modify "System eth0" +ipv4.addresses 192.168.122.51/24
sudo nmcli connection up "System eth0"
ip -4 -br addr show eth0

eth0             UP             192.168.122.50/24 192.168.122.51/24

A new connection for another NIC

sudo nmcli connection add type ethernet con-name storage-net ifname eth1 \
    ipv4.method manual ipv4.addresses 10.10.10.50/24 \
    ipv6.method disabled connection.autoconnect yes
sudo nmcli connection up storage-net

Connection 'storage-net' (b1c0f1b6-6b2a-4a7e-8d8a-1d4fb5c6f9a7) successfully added.
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/5)

The file behind it

sudo ls -l /etc/NetworkManager/system-connections/
sudo cat /etc/NetworkManager/system-connections/storage-net.nmconnection

-rw-------. 1 root root 288 Nov  3 13:20 storage-net.nmconnection

[connection]
id=storage-net
uuid=b1c0f1b6-6b2a-4a7e-8d8a-1d4fb5c6f9a7
type=ethernet
interface-name=eth1

[ethernet]

[ipv4]
address1=10.10.10.50/24
method=manual

[ipv6]
addr-gen-mode=default
method=disabled

[proxy]

The mode is 600 because keyfiles can hold Wi-Fi passwords and VPN secrets; NetworkManager ignores keyfiles that other users can read. If you edit a keyfile by hand, apply it with sudo nmcli connection reload, then nmcli connection up NAME.

Back to DHCP, and cleanup

sudo nmcli connection modify storage-net ipv4.method auto ipv4.addresses "" ipv4.gateway ""
sudo nmcli connection delete storage-net

For DHCP, clear the static values as well as setting auto; otherwise the old address remains in the file. nmtui offers the same edits through menus, handy when you forget a property name, but practise nmcli because it is quicker and can be pasted into notes.

Going further

nmcli device reapply eth0 applies changes without a full reconnect. nmcli connection modify NAME ipv4.routes "10.20.0.0/16 192.168.122.254" adds a static route and ipv4.ignore-auto-dns yes keeps DHCP from overwriting your DNS. nmcli general status gives an overview, nmcli connection monitor prints events as they happen, and journalctl -u NetworkManager shows why a connection failed. Bonds, bridges and VLANs are further connection types in the same tool: nmcli connection add type bond .... Changing a connection’s MTU or MAC address uses 802-3-ethernet.mtu and 802-3-ethernet.cloned-mac-address.

Practice

0 of 6 done

Do these on your own system. They get harder. Check each result, then tick it off.

Warm-upDone
Read the connection before changing it
Before you edit anything, record the current IPv4 method, address, gateway and DNS of your main connection, and the name of its keyfile. Write down how you would undo your change.
Check your result
nmcli connection show NAME prints the ipv4.* values; ls /etc/NetworkManager/system-connections shows the keyfile. You have a copy of the values to restore.
Hint
nmcli -f ipv4 connection show NAME limits the output to IPv4 settings. sudo cp -a the keyfile as a backup.
Solution
```
nmcli -f ipv4 connection show "System eth0"
sudo ls -l /etc/NetworkManager/system-connections/
sudo cp -a /etc/NetworkManager/system-connections /root/nm-backup
```
PracticeDone
A fixed IPv4 configuration
Using the connection that serves your main interface, configure: address 192.168.122.50/24, gateway 192.168.122.1, DNS 192.168.122.1, search domain lab.example, static method, auto-connect at boot. Apply it and verify addresses, route and DNS. (Adapt the addresses to your own lab network and take care: a wrong address over SSH locks you out. Use the VM console.)
Check your result
ip -br addr shows 192.168.122.50/24. ip route shows default via 192.168.122.1. nmcli -g ipv4.method connection show NAME prints manual. grep search /etc/resolv.conf shows lab.example.
Hint
nmcli connection modify NAME ipv4.method manual ipv4.addresses ... ipv4.gateway ... ipv4.dns ... ipv4.dns-search ..., then nmcli connection up NAME.
Solution
```
nmcli device status
sudo nmcli connection modify "System eth0" \
    ipv4.method manual \
    ipv4.addresses 192.168.122.50/24 \
    ipv4.gateway 192.168.122.1 \
    ipv4.dns 192.168.122.1 \
    ipv4.dns-search lab.example \
    connection.autoconnect yes
sudo nmcli connection up "System eth0"
ip -br addr
ip route
cat /etc/resolv.conf
```
PracticeDone
Add an IPv6 address
On the same connection set a static IPv6 address fd00:122::50/64 with gateway fd00:122::1 and DNS fd00:122::1, keeping IPv4 unchanged. Apply and verify with ip -6. Then ping your own IPv6 address.
Check your result
ip -6 addr show dev eth0 lists fd00:122::50/64. ping -6 -c1 fd00:122::50 succeeds. The IPv4 settings are unchanged.
Hint
ipv6.method manual ipv6.addresses fd00:122::50/64 ipv6.gateway fd00:122::1 ipv6.dns fd00:122::1. The gateway need not answer for the address to appear.
Solution
```
sudo nmcli connection modify "System eth0" \
    ipv6.method manual \
    ipv6.addresses fd00:122::50/64 \
    ipv6.gateway fd00:122::1 \
    ipv6.dns fd00:122::1
sudo nmcli connection up "System eth0"
ip -6 addr show dev eth0
ping -6 -c1 fd00:122::50
```
PracticeDone
Two addresses on one interface
Add a secondary IPv4 address 192.168.122.51/24 to the same connection without removing the first. Verify both exist. Then remove only the secondary one.
Check your result
ip -4 addr show eth0 lists both addresses. After removal only .50 remains.
Hint
A plus sign before the property appends: +ipv4.addresses. A minus sign removes: -ipv4.addresses.
Solution
```
sudo nmcli connection modify "System eth0" +ipv4.addresses 192.168.122.51/24
sudo nmcli connection up "System eth0"
ip -4 addr show eth0
sudo nmcli connection modify "System eth0" -ipv4.addresses 192.168.122.51/24
sudo nmcli connection up "System eth0"
ip -4 addr show eth0
```
PracticeDone
Configure a second network card
The VM has a second NIC eth1, unconfigured. Create a new connection named storage-net for it with static address 10.10.10.50/24, no gateway, starting automatically at boot. Verify it is up, and persists after a reboot.
Check your result
nmcli connection show lists storage-net on device eth1 and ip -br addr show eth1 shows 10.10.10.50/24. After reboot it is still up.
Hint
nmcli connection add type ethernet con-name storage-net ifname eth1 ipv4.method manual ipv4.addresses 10.10.10.50/24 connection.autoconnect yes.
Solution
```
sudo nmcli connection add type ethernet con-name storage-net ifname eth1 \
    ipv4.method manual ipv4.addresses 10.10.10.50/24 \
    ipv6.method disabled connection.autoconnect yes
sudo nmcli connection up storage-net
ip -br addr show eth1
sudo reboot
```
ChallengeDone
Look at the stored file; go back to DHCP
Find the file on disk where storage-net is stored, show its permissions and contents, and explain why the mode matters. Then return the connection to DHCP: clear the static addresses and set the automatic method. Finally delete the connection.
Check your result
/etc/NetworkManager/system-connections/storage-net.nmconnection exists with mode 600. After the change ipv4.method is auto and ipv4.addresses is empty. nmcli con show no longer lists it after delete.
Hint
nmcli connection modify NAME ipv4.method auto ipv4.addresses "" ipv4.gateway "". NetworkManager refuses keyfiles that others can read, because they can contain secrets.
Solution
```
sudo ls -l /etc/NetworkManager/system-connections/
sudo cat /etc/NetworkManager/system-connections/storage-net.nmconnection
sudo nmcli connection modify storage-net ipv4.method auto ipv4.addresses "" ipv4.gateway ""
nmcli -g ipv4.method,ipv4.addresses connection show storage-net
sudo nmcli connection delete storage-net
nmcli connection show
```

The idea

The properties you need

Try it

IPv6 and a second address

A new connection for another NIC

The file behind it

Back to DHCP, and cleanup

Going further

Read the connection before changing it

A fixed IPv4 configuration

Add an IPv6 address

Two addresses on one interface

Configure a second network card

Look at the stored file; go back to DHCP