community.general.nmcli module – Manage Networking
Note
This module is part of the community.general collection (version 10.1.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install community.general.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: community.general.nmcli.
Synopsis
Manage the network devices. Create, modify and manage various connection and device type e.g., ethernet, teams, bonds, vlans etc.
On CentOS 8 and Fedora >=29 like systems, the requirements can be met by installing the following packages: NetworkManager.
On CentOS 7 and Fedora <=28 like systems, the requirements can be met by installing the following packages: NetworkManager-tui.
On Ubuntu and Debian like systems, the requirements can be met by installing the following packages: network-manager
On openSUSE, the requirements can be met by installing the following packages: NetworkManager.
Requirements
The below requirements are needed on the host that executes this module.
nmcli
Parameters
Parameter |
Comments |
|---|---|
Configure method for creating the address for use with IPv6 Stateless Address Autoconfiguration.
Choices:
|
|
This is only used with bridge - [ageing-time <0-1000000>] the Ethernet MAC address aging time, in seconds. Default: |
|
This is only used with bond - ARP interval. |
|
This is only used with bond - ARP IP target. |
|
Whether the connection should start on boot. Whether the connection profile can be automatically activated Choices:
|
|
The name used to call the connection. Pattern is <type>[-<ifname>][-<num>]. |
|
Whether the connection should be reloaded if it was modified. Choices:
|
|
DHCP Client Identifier sent to the DHCP server. |
|
A list of up to 3 DNS servers. The entries must be IPv4 addresses, for example |
|
Ignore automatically configured IPv4 name servers. Choices:
|
|
A list of DNS options. |
|
A list of DNS search domains. |
|
A list of up to 3 DNS servers. The entries must be IPv6 addresses, for example |
|
Ignore automatically configured IPv6 name servers. Choices:
|
|
A list of DNS options. |
|
A list of DNS search domains. |
|
This is only used with bond - downdelay. |
|
This is only used with VLAN - VLAN egress priority mapping. |
|
This is only used with VLAN - flags. |
|
This is only used with bridge - [forward-delay <2-30>] STP forwarding delay, in seconds. Default: |
|
The configuration of the GSM connection. Note the list of suboption attributes may vary depending on which version of NetworkManager/nmcli is installed on the host. An up-to-date list of supported attributes can be found here: https://networkmanager.dev/docs/api/latest/settings-gsm.html. For instance to use apn, pin, username and password: |
|
The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network. The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user’s mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9. |
|
When Choices:
|
|
The device unique identifier (as given by the If given, the connection will only apply to the specified device. |
|
When Connections to roaming networks will not be made. Choices:
|
|
If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames. Default: |
|
The Network ID (GSM LAI format, ie MCC-MNC) to force specific network registration. If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible. |
|
Legacy setting that used to help establishing PPP data sessions for GSM-based modems. |
|
The password used to authenticate with the network, if required. Many providers do not require a password, or accept any password. But if a password is required, it is specified here. |
|
NMSettingSecretFlags indicating how to handle the Following choices are allowed: Choices:
|
|
If the SIM is locked with a PIN it must be unlocked before any other operations are requested. Specify the PIN here to allow operation of the device. |
|
NMSettingSecretFlags indicating how to handle the See Choices:
|
|
The SIM card unique identifier (as given by the If given, the connection will apply to any device also allowed by |
|
A MCC/MNC string like If given, the connection will apply to any device also allowed by |
|
The username used to authenticate with the network, if required. Many providers do not require a username, or accept any username. But if a username is required, it is specified here. |
|
The IPv4 gateway for this interface. Use the format This parameter is mutually_exclusive with never_default4 parameter. |
|
Ignore automatically configured IPv4 routes. Choices:
|
|
The IPv6 gateway for this interface. Use the format |
|
Ignore automatically configured IPv6 routes. Choices:
|
|
This is only used with ‘bridge-slave’ - ‘hairpin mode’ for the slave, which allows frames to be sent back out through the slave the frame was received on. The default change to Choices:
|
|
This is only used with bridge - [hello-time <1-10>] STP hello time, in seconds. Default: |
|
The interface to bind the connection to. The connection will only be applicable to this interface name. A special value of The ifname argument is mandatory for all connection types except bond, team, bridge, vlan and vpn. This parameter defaults to |
|
This is only used with VLAN - VLAN ingress priority mapping. |
|
List of IPv4 addresses to this interface. Use the format If defined and |
|
List of IPv6 addresses to this interface. Use the format If defined and |
|
If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one. Choices:
|
|
This is used with GRE/IPIP/SIT - parent device this GRE/IPIP/SIT tunnel, can use ifname. |
|
The key used for tunnel input packets. Only used when |
|
This is used with GRE/IPIP/SIT - GRE/IPIP/SIT local IP address. |
|
The key used for tunnel output packets. Only used when |
|
This is used with GRE/IPIP/SIT - GRE/IPIP/SIT destination IP address. |
|
MAC address of the connection. Note this requires a recent kernel feature, originally introduced in 3.15 upstream kernel. |
|
The configuration of the MAC VLAN connection. Note the list of suboption attributes may vary depending on which version of NetworkManager/nmcli is installed on the host. An up-to-date list of supported attributes can be found here: https://networkmanager.dev/docs/api/latest/settings-macvlan.html. |
|
The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device. Following choices are allowed: Choices:
|
|
If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created. If this property is not specified, the connection must contain an “802-3-ethernet” setting with a “mac-address” property. |
|
Whether the interface should be put in promiscuous mode. Choices:
|
|
Whether the interface should be a MACVTAP. Choices:
|
|
Master <master (ifname, or connection UUID or conn_name) of bridge, team, bond, ovs-port master connection profile. Mandatory if |
|
This is only used with bridge - [max-age <6-42>] STP maximum message age, in seconds. Default: |
|
Configuration method to be used for IPv4. If Choices:
|
|
Configuration method to be used for IPv6 If
Choices:
|
|
This is only used with bond - miimon. This parameter defaults to |
|
This is the type of device or network connection that you wish to create for a bond or bridge. Choices:
|
|
The connection MTU, e.g. 9000. This can’t be applied when creating the interface and is done once the interface has been created. Can be used when modifying Team, VLAN, Ethernet (Future plans to implement wifi, gsm, pppoe, infiniband) This parameter defaults to |
|
Set as default route. This parameter is mutually_exclusive with gw4 parameter. Choices:
|
|
This is only used with ‘bridge-slave’ - [<1-65535>] - STP port cost for destinations via this slave. Default: |
|
This is only used with bond and is the primary interface name (for “active-backup” mode), this is the usually the ‘ifname’. |
|
This is only used with ‘bridge’ - sets STP priority. Default: |
|
Set metric level of ipv4 routes configured on interface. |
|
Set metric level of IPv6 routes configured on interface. |
|
The list of IPv4 routes. Use the format To specify more complex routes, use the |
|
The list of IPv4 routes. |
|
The clamp for congestion window. |
|
IP or prefix of route. Use the format |
|
Route metric. |
|
If non-zero, only transmit packets of the specified size or smaller. |
|
Use the format |
|
Pretend that the nexthop is directly attached to this link, even if it does not match any interface prefix. Choices:
|
|
The table to add this route to. The default depends on |
|
The Type Of Service. |
|
The list of IPv6 routes. Use the format To specify more complex routes, use the |
|
The list of IPv6 routes but with parameters. |
|
The clamp for congestion window. |
|
IP or prefix of route. Use the format |
|
Route metric. |
|
If non-zero, only transmit packets of the specified size or smaller. |
|
Use the format |
|
Pretend that the nexthop is directly attached to this link, even if it does not match any interface prefix. Choices:
|
|
The table to add this route to. The default depends on |
|
Is the same as in an |
|
This is the type of device or network connection that you wish to create for a team. Choices:
|
|
Option specifies the rate at which our link partner is asked to transmit LACPDU packets. If this is Only allowed for Choices:
|
|
This defines the policy of how hardware addresses of team device and port devices should be set during the team lifetime. Choices:
|
|
Type of the device of this slave’s master connection (for example Type Choices:
|
|
This is only used with ‘bridge-slave’ - [<0-63>] - STP priority of this slave. Default: |
|
Allow to configure SR-IOV settings. An up-to-date list of supported attributes can be found here: https://networkmanager.pages.freedesktop.org/NetworkManager/NetworkManager/settings-sriov.html. |
|
Whether to autoprobe virtual functions by a compatible driver. |
|
Select the eswitch encapsulation support. |
|
Select the eswitch inline-mode of the device. |
|
Select the eswitch mode of the device. |
|
Number of virtual functions to create. Consult your NIC documentation for the maximum number of VFs supported. |
|
Virtual function descriptors in the form: Multiple VFs can be specified using a comma as separator, for example |
|
Name of the Wireless router or the access point. |
|
Whether the device should exist or not, taking action if the state is different from what is stated. Using Using Choices:
|
|
This is only used with bridge and controls whether Spanning Tree Protocol (STP) is enabled for this bridge. Choices:
|
|
This option sets the connection type of Infiniband IPoIB devices. Choices:
|
|
This is the type of device or network connection that you wish to create or modify. Type Type Type Type Type Type Type Type Type Type Using If you want to control non-ethernet connection attached to Choices:
|
|
This is only used with bond - updelay. |
|
This is only used with VLAN - parent device this VLAN is on, can use ifname. |
|
This is only used with VLAN - VLAN ID in range <0-4095>. |
|
Configuration of a VPN connection (PPTP and L2TP). In order to use L2TP you need to be sure that |
|
The gateway to connection. It can be an IP address (for example |
|
Enable or disable IPSec tunnel to L2TP host. This option is need when Choices:
|
|
The pre-shared key in base64 encoding. You can encode using this Ansible jinja2 expression: This is only used when |
|
NMSettingSecretFlags indicating how to handle the Following choices are allowed: Choices:
|
|
User that will have permission to use the connection. |
|
This defines the service type of connection. |
|
Username provided by VPN administrator. |
|
This is only used with VXLAN - VXLAN ID. |
|
This is only used with VXLAN - VXLAN local IP address. |
|
This is only used with VXLAN - VXLAN destination IP address. |
|
The configuration of the WiFi connection. Note the list of suboption attributes may vary depending on which version of NetworkManager/nmcli is installed on the host. An up-to-date list of supported attributes can be found here: https://networkmanager.dev/docs/api/latest/settings-802-11-wireless.html. For instance to create a hidden AP mode WiFi connection: |
|
Configures AP isolation, which prevents communication between wireless devices connected to this AP. This property can be set to a value different from If set to If set to When set to Choices:
|
|
The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values This field replaces the deprecated Note that this property only exists in D-Bus API. libnm and nmcli continue to call this property |
|
802.11 frequency band of the network. One of This will lock associations to the Wi-Fi network to the specific band, so for example, if This setting depends on specific driver capability and may not work with all drivers. Choices:
|
|
If specified, directs the device to only associate with the given access point. This capability is highly driver dependent and not supported by all devices. Note this property does not control the BSSID used when creating an Ad-Hoc network and is unlikely to in the future. |
|
Wireless channel to use for the Wi-Fi connection. The device will only join (or create for Ad-Hoc networks) a Wi-Fi network on the specified channel. Because channel numbers overlap between bands, this property also requires the Default: |
|
This D-Bus field is deprecated in favor of For libnm and nmcli, this field is called |
|
With Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is If the value is still If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of A value of If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, |
|
If In infrastructure mode, various workarounds are used for a more reliable discovery of hidden networks, such as probe-scanning the SSID. However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution. In AP mode, the created network does not broadcast its SSID. Note that marking the network as hidden may be a privacy issue for you (in infrastructure mode) or client stations (in AP mode), as the explicit probe-scans are distinctly recognizable on the air. Choices:
|
|
If specified, this connection will only apply to the Wi-Fi device whose permanent MAC address matches. This property does not change the MAC address of the device (for example for MAC spoofing). |
|
A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply. Each MAC address should be given in the standard hex-digits-and-colons notation (for example, |
|
One of This property is deprecated for Choices:
|
|
Wi-Fi network mode. If blank, Choices:
|
|
If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames. Default: |
|
One of All other values are reserved. Choices:
|
|
If non-zero, directs the device to only use the specified bitrate for communication with the access point. Units are in Kb/s, so for example This property is highly driver dependent and not all devices support setting a static bitrate. Default: |
|
If non-zero, directs the device to use the specified transmit power. Units are dBm. This property is highly driver dependent and not all devices support setting a static transmit power. Default: |
|
The NMSettingWirelessWakeOnWLan options to enable. Not all devices support all options. May be any combination of Note the option values’ sum must be specified in order to combine multiple options. Default: |
|
The security configuration of the WiFi connection. Note the list of suboption attributes may vary depending on which version of NetworkManager/nmcli is installed on the host. An up-to-date list of supported attributes can be found here: https://networkmanager.dev/docs/api/latest/settings-802-11-wireless-security.html. For instance to use common WPA-PSK auth with a password: |
|
When WEP is used (that is, if One of When using Cisco LEAP (that is, if Choices:
|
|
Indicates whether Fast Initial Link Setup (802.11ai) must be enabled for the connection. One of When set to Choices:
|
|
A list of group/broadcast encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty. Choices:
|
|
Key management used for the connection. One of This property must be set for any Wi-Fi connection that uses security. Choices:
|
|
The login password for legacy LEAP connections (that is, if |
|
Flags indicating how to handle the |
|
The login username for legacy LEAP connections (that is, if |
|
A list of pairwise encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty. Choices:
|
|
Indicates whether Protected Management Frames (802.11w) must be enabled for the connection. One of When set to Choices:
|
|
List of strings specifying the allowed WPA protocol versions to use. Each element may be If not specified, both WPA and RSN connections are allowed. Choices:
|
|
Pre-Shared-Key for WPA networks. For WPA-PSK, it is either an ASCII passphrase of 8 to 63 characters that is (as specified in the 802.11i standard) hashed to derive the actual key, or the key in form of 64 hexadecimal character. The WPA3-Personal networks use a passphrase of any length for SAE authentication. |
|
Flags indicating how to handle the |
|
Flags indicating how to handle the |
|
Controls the interpretation of WEP keys. Allowed values are Choices:
|
|
Index 0 WEP key. This is the WEP key used in most networks. See the |
|
Index 1 WEP key. This WEP index is not used by most networks. See the |
|
Index 2 WEP key. This WEP index is not used by most networks. See the |
|
Index 3 WEP key. This WEP index is not used by most networks. See the |
|
When static WEP is used (that is, if Valid values are Note that some consumer access points (like the Linksys WRT54G) number the keys Choices:
|
|
Flags indicating which mode of WPS is to be used if any. There is little point in changing the default setting as NetworkManager will automatically determine whether it is feasible to start WPS enrollment from the Access Point capabilities. WPS can be disabled by setting this property to a value of Default: |
|
The configuration of the Wireguard connection. Note the list of suboption attributes may vary depending on which version of NetworkManager/nmcli is installed on the host. An up-to-date list of supported attributes can be found here: https://networkmanager.dev/docs/api/latest/settings-wireguard.html. For instance to configure a listen port: |
|
The 32-bit fwmark for outgoing packets. The use of fwmark is optional and is by default off. Setting it to 0 disables it. Note that |
|
Whether to enable special handling of the IPv4 default route. If enabled, the IPv4 default route from The fwmark number is also used as routing-table for the default-route, and if fwmark is zero, an unused fwmark/table is chosen automatically. This corresponds to what wg-quick does with Table=auto and what WireGuard calls “Improved Rule-based Routing” Choices:
|
|
The WireGuard connection listen-port. If not specified, the port will be chosen randomly when the interface comes up. |
|
If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments. If zero a default MTU is used. Note that contrary to wg-quick’s MTU setting, this does not take into account the current routes at the time of activation. |
|
Whether to automatically add routes for the AllowedIPs ranges of the peers. If If Note that if the peer’s AllowedIPs is Choices:
|
|
The 256 bit private-key in base64 encoding. |
|
This is only used with bond - xmit_hash_policy type. |
|
The trust level of the connection. When updating this property on a currently activated connection, the change takes effect immediately. |
Attributes
Attribute |
Support |
Description |
|---|---|---|
Support: full |
Can run in |
|
Support: full |
Will return details on what has changed (or possibly needs changing in |
Examples
# These examples are using the following inventory:
#
# ## Directory layout:
#
# |_/inventory/cloud-hosts
# | /group_vars/openstack-stage.yml
# | /host_vars/controller-01.openstack.host.com
# | /host_vars/controller-02.openstack.host.com
# |_/playbook/library/nmcli.py
# | /playbook-add.yml
# | /playbook-del.yml
# ```
#
# ## inventory examples
# ### groups_vars
# ```yml
# ---
# #devops_os_define_network
# storage_gw: "192.0.2.254"
# external_gw: "198.51.100.254"
# tenant_gw: "203.0.113.254"
#
# #Team vars
# nmcli_team:
# - conn_name: tenant
# ip4: '{{ tenant_ip }}'
# gw4: '{{ tenant_gw }}'
# - conn_name: external
# ip4: '{{ external_ip }}'
# gw4: '{{ external_gw }}'
# - conn_name: storage
# ip4: '{{ storage_ip }}'
# gw4: '{{ storage_gw }}'
# nmcli_team_slave:
# - conn_name: em1
# ifname: em1
# master: tenant
# - conn_name: em2
# ifname: em2
# master: tenant
# - conn_name: p2p1
# ifname: p2p1
# master: storage
# - conn_name: p2p2
# ifname: p2p2
# master: external
#
# #bond vars
# nmcli_bond:
# - conn_name: tenant
# ip4: '{{ tenant_ip }}'
# gw4: ''
# mode: balance-rr
# - conn_name: external
# ip4: '{{ external_ip }}'
# gw4: ''
# mode: balance-rr
# - conn_name: storage
# ip4: '{{ storage_ip }}'
# gw4: '{{ storage_gw }}'
# mode: balance-rr
# nmcli_bond_slave:
# - conn_name: em1
# ifname: em1
# master: tenant
# - conn_name: em2
# ifname: em2
# master: tenant
# - conn_name: p2p1
# ifname: p2p1
# master: storage
# - conn_name: p2p2
# ifname: p2p2
# master: external
#
# #ethernet vars
# nmcli_ethernet:
# - conn_name: em1
# ifname: em1
# ip4:
# - '{{ tenant_ip }}'
# - '{{ second_tenant_ip }}'
# gw4: '{{ tenant_gw }}'
# - conn_name: em2
# ifname: em2
# ip4: '{{ tenant_ip1 }}'
# gw4: '{{ tenant_gw }}'
# - conn_name: p2p1
# ifname: p2p1
# ip4: '{{ storage_ip }}'
# gw4: '{{ storage_gw }}'
# - conn_name: p2p2
# ifname: p2p2
# ip4: '{{ external_ip }}'
# gw4: '{{ external_gw }}'
# ```
#
# ### host_vars
# ```yml
# ---
# storage_ip: "192.0.2.91/23"
# external_ip: "198.51.100.23/21"
# tenant_ip: "203.0.113.77/23"
# second_tenant_ip: "204.0.113.77/23"
# ```
## playbook-add.yml example
---
- hosts: openstack-stage
remote_user: root
tasks:
- name: Install needed network manager libs
ansible.builtin.package:
name:
- NetworkManager-libnm
- nm-connection-editor
- libsemanage-python
- policycoreutils-python
state: present
##### Working with all cloud nodes - Teaming
- name: Try nmcli add team - conn_name only & ip4 gw4
community.general.nmcli:
type: team
conn_name: '{{ item.conn_name }}'
ip4: '{{ item.ip4 }}'
gw4: '{{ item.gw4 }}'
state: present
with_items:
- '{{ nmcli_team }}'
- name: Try nmcli add teams-slave
community.general.nmcli:
type: team-slave
conn_name: '{{ item.conn_name }}'
ifname: '{{ item.ifname }}'
master: '{{ item.master }}'
state: present
with_items:
- '{{ nmcli_team_slave }}'
###### Working with all cloud nodes - Bonding
- name: Try nmcli add bond - conn_name only & ip4 gw4 mode
community.general.nmcli:
type: bond
conn_name: '{{ item.conn_name }}'
ip4: '{{ item.ip4 }}'
gw4: '{{ item.gw4 }}'
mode: '{{ item.mode }}'
state: present
with_items:
- '{{ nmcli_bond }}'
- name: Try nmcli add bond-slave
community.general.nmcli:
type: bond-slave
conn_name: '{{ item.conn_name }}'
ifname: '{{ item.ifname }}'
master: '{{ item.master }}'
state: present
with_items:
- '{{ nmcli_bond_slave }}'
##### Working with all cloud nodes - Ethernet
- name: Try nmcli add Ethernet - conn_name only & ip4 gw4
community.general.nmcli:
type: ethernet
conn_name: '{{ item.conn_name }}'
ip4: '{{ item.ip4 }}'
gw4: '{{ item.gw4 }}'
state: present
with_items:
- '{{ nmcli_ethernet }}'
## playbook-del.yml example
- hosts: openstack-stage
remote_user: root
tasks:
- name: Try nmcli del team - multiple
community.general.nmcli:
conn_name: '{{ item.conn_name }}'
state: absent
with_items:
- conn_name: em1
- conn_name: em2
- conn_name: p1p1
- conn_name: p1p2
- conn_name: p2p1
- conn_name: p2p2
- conn_name: tenant
- conn_name: storage
- conn_name: external
- conn_name: team-em1
- conn_name: team-em2
- conn_name: team-p1p1
- conn_name: team-p1p2
- conn_name: team-p2p1
- conn_name: team-p2p2
- name: Add an Ethernet connection with static IP configuration
community.general.nmcli:
conn_name: my-eth1
ifname: eth1
type: ethernet
ip4: 192.0.2.100/24
gw4: 192.0.2.1
state: present
- name: Add an Team connection with static IP configuration
community.general.nmcli:
conn_name: my-team1
ifname: my-team1
type: team
ip4: 192.0.2.100/24
gw4: 192.0.2.1
state: present
autoconnect: true
- name: Optionally, at the same time specify IPv6 addresses for the device
community.general.nmcli:
conn_name: my-eth1
ifname: eth1
type: ethernet
ip4: 192.0.2.100/24
gw4: 192.0.2.1
ip6: 2001:db8::cafe
gw6: 2001:db8::1
state: present
- name: Add two IPv4 DNS server addresses
community.general.nmcli:
conn_name: my-eth1
type: ethernet
dns4:
- 192.0.2.53
- 198.51.100.53
state: present
- name: Make a profile usable for all compatible Ethernet interfaces
community.general.nmcli:
ctype: ethernet
name: my-eth1
ifname: '*'
state: present
- name: Change the property of a setting e.g. MTU
community.general.nmcli:
conn_name: my-eth1
mtu: 9000
type: ethernet
state: present
- name: Change the property of a setting e.g. MTU and reload connection
community.general.nmcli:
conn_name: my-eth1
mtu: 1500
type: ethernet
state: present
conn_reload: true
- name: Disable connection
community.general.nmcli:
conn_name: my-eth1
state: down
- name: Reload and enable connection
community.general.nmcli:
conn_name: my-eth1
state: up
reload: true
- name: Add second ip4 address
community.general.nmcli:
conn_name: my-eth1
ifname: eth1
type: ethernet
ip4:
- 192.0.2.100/24
- 192.0.3.100/24
state: present
- name: Add second ip6 address
community.general.nmcli:
conn_name: my-eth1
ifname: eth1
type: ethernet
ip6:
- 2001:db8::cafe
- 2002:db8::cafe
state: present
- name: Add VxLan
community.general.nmcli:
type: vxlan
conn_name: vxlan_test1
vxlan_id: 16
vxlan_local: 192.168.1.2
vxlan_remote: 192.168.1.5
- name: Add gre
community.general.nmcli:
type: gre
conn_name: gre_test1
ip_tunnel_dev: eth0
ip_tunnel_local: 192.168.1.2
ip_tunnel_remote: 192.168.1.5
- name: Add ipip
community.general.nmcli:
type: ipip
conn_name: ipip_test1
ip_tunnel_dev: eth0
ip_tunnel_local: 192.168.1.2
ip_tunnel_remote: 192.168.1.5
- name: Add sit
community.general.nmcli:
type: sit
conn_name: sit_test1
ip_tunnel_dev: eth0
ip_tunnel_local: 192.168.1.2
ip_tunnel_remote: 192.168.1.5
- name: Add zone
community.general.nmcli:
type: ethernet
conn_name: my-eth1
zone: external
state: present
# nmcli exits with status 0 if it succeeds and exits with a status greater
# than zero when there is a failure. The following list of status codes may be
# returned:
#
# - 0 Success - indicates the operation succeeded
# - 1 Unknown or unspecified error
# - 2 Invalid user input, wrong nmcli invocation
# - 3 Timeout expired (see --wait option)
# - 4 Connection activation failed
# - 5 Connection deactivation failed
# - 6 Disconnecting device failed
# - 7 Connection deletion failed
# - 8 NetworkManager is not running
# - 9 nmcli and NetworkManager versions mismatch
# - 10 Connection, device, or access point does not exist.
- name: Create the wifi connection
community.general.nmcli:
type: wifi
conn_name: Brittany
ifname: wlp4s0
ssid: Brittany
wifi_sec:
key-mgmt: wpa-psk
psk: my_password
autoconnect: true
state: present
- name: Create a hidden AP mode wifi connection
community.general.nmcli:
type: wifi
conn_name: ChocoMaster
ifname: wlo1
ssid: ChocoMaster
wifi:
hidden: true
mode: ap
autoconnect: true
state: present
- name: Create a gsm connection
community.general.nmcli:
type: gsm
conn_name: my-gsm-provider
ifname: cdc-wdm0
gsm:
apn: my.provider.apn
username: my-provider-username
password: my-provider-password
pin: my-sim-pin
autoconnect: true
state: present
- name: Create a macvlan connection
community.general.nmcli:
type: macvlan
conn_name: my-macvlan-connection
ifname: mymacvlan0
macvlan:
mode: 2
parent: eth1
autoconnect: true
state: present
- name: Create a wireguard connection
community.general.nmcli:
type: wireguard
conn_name: my-wg-provider
ifname: mywg0
wireguard:
listen-port: 51820
private-key: my-private-key
autoconnect: true
state: present
- name: >-
Create a VPN L2TP connection for ansible_user to connect on vpn.example.com
authenticating with user 'brittany' and pre-shared key as 'Brittany123'
community.general.nmcli:
type: vpn
conn_name: my-vpn-connection
vpn:
permissions: "{{ ansible_user }}"
service-type: org.freedesktop.NetworkManager.l2tp
gateway: vpn.example.com
password-flags: 2
user: brittany
ipsec-enabled: true
ipsec-psk: "0s{{ 'Brittany123' | ansible.builtin.b64encode }}"
autoconnect: false
state: present
## Creating bond attached to bridge example
- name: Create bond attached to bridge
community.general.nmcli:
type: bond
conn_name: bond0
slave_type: bridge
master: br0
state: present
- name: Create master bridge
community.general.nmcli:
type: bridge
conn_name: br0
method4: disabled
method6: disabled
state: present
## Creating vlan connection attached to bridge
- name: Create master bridge
community.general.nmcli:
type: bridge
conn_name: br0
state: present
- name: Create VLAN 5
community.general.nmcli:
type: vlan
conn_name: eth0.5
slave_type: bridge
master: br0
vlandev: eth0
vlanid: 5
state: present
## Defining ip rules while setting a static IP
## table 'production' is set with id 200 in this example.
- name: Set Static ips for interface with ip rules and routes
community.general.nmcli:
type: ethernet
conn_name: 'eth0'
ip4: '192.168.1.50'
gw4: '192.168.1.1'
state: present
routes4_extended:
- ip: "0.0.0.0/0"
next_hop: "192.168.1.1"
table: "production"
routing_rules4:
- "priority 0 from 192.168.1.50 table 200"
## Creating an OVS bridge and attaching a port
- name: Create OVS Bridge
community.general.nmcli:
conn_name: ovs-br-conn
ifname: ovs-br
type: ovs-bridge
state: present
- name: Create OVS Port for OVS Bridge Interface
community.general.nmcli:
conn_name: ovs-br-interface-port-conn
ifname: ovs-br-interface-port
master: ovs-br
type: ovs-port
state: present
## Adding an ethernet interface to an OVS bridge port
- name: Add Ethernet Interface to OVS Port
community.general.nmcli:
conn_name: eno1
ifname: eno1
master: ovs-br-interface-port
slave_type: ovs-port
type: ethernet
state: present