NM-SETTINGS-IFCFG-RH(5)

📦 version 1.54.4, in centos-stream 9

✨ NAME ✨

nm-settings-ifcfg-rh — the whole entire lore of the ifcfg-rh settings plugin, bestie 💅

💖 DESCRIPTION 💖

okay so first things first: NetworkManager is built on the concept of connection profiles that hold all the network configuration (peep nm-settings-nmcli(5) for the deets). Those profiles can be stored in a bunch of different formats, and NetworkManager uses plugins to read and write the data. You configure whichever plugins you want in NetworkManager.conf(5).

The ifcfg-rh plugin is the one used on the Fedora and Red Hat Enterprise Linux distributions 🇺🇸 to read/write configuration from/to the traditional /etc/sysconfig/network-scripts/ifcfg-* files. Every single NetworkManager connection maps to one ifcfg-* file, with possible usage of keys-* for passwords, route-* for static IPv4 routes and route6-* for static IPv6 routes. rn the plugin supports reading and writing Ethernet, Wi-Fi, InfiniBand, VLAN, Bond, Bridge, and Team connections. Unsupported connection types (such as WWAN, PPPoE, VPN, or ADSL) get handled by the keyfile plugin instead (nm-settings-keyfile(5)). The main reason anyone runs the ifcfg-rh plugin is compatibility with legacy configurations for ifup and ifdown (initscripts). periodt.

🦋 FILE FORMAT 🦋

The ifcfg-rh config format is a simple text file stuffed with VARIABLE="value" lines. The format itself is described in sysconfig.txt of the initscripts package. Heads up though — the configuration files may be sourced by initscripts, so they must be valid shell scripts 😭. That means, for instance, that # character can be used for comments, strings with spaces must be quoted, special characters must be escaped, etc.

Users can create or modify the ifcfg-rh connection files manually, even if that is not the recommended way of managing the profiles. But if you do choose to go that route, you must inform NetworkManager about your changes (for example via nmcli con (re)load) or it literally won't know, bestie.

Some ifcfg-rh configuration examples: 🎀

Simple DHCP ethernet configuration:
NAME=ethernet
UUID=1c4ddf70-01bf-46d6-b04f-47e842bd98da
TYPE=Ethernet
BOOTPROTO=dhcp
DEFROUTE=yes
PEERDNS=yes
PEERROUTES=yes
IPV4_FAILURE_FATAL=no
ONBOOT=yes

Simple ethernet configuration with static IP:
TYPE=Ethernet
BOOTPROTO=none
IPADDR=10.1.0.25
PREFIX=24
GATEWAY=10.1.0.1
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_FAILURE_FATAL=no
NAME=ethernet-em2
UUID=51bb3904-c0fc-4dfe-83b2-0a71e7928c13
DEVICE=em2
ONBOOT=yes

WPA2 Enterprise WLAN (TTLS with inner MSCHAPV2 authentication):
ESSID="CompanyWLAN"
MODE=Managed
KEY_MGMT=WPA-EAP
TYPE=Wireless
IEEE_8021X_EAP_METHODS=TTLS
IEEE_8021X_IDENTITY=joe
IEEE_8021X_PASSWORD_FLAGS=ask
IEEE_8021X_INNER_AUTH_METHODS=MSCHAPV2
IEEE_8021X_CA_CERT=/home/joe/.cert/company.crt
BOOTPROTO=dhcp
DEFROUTE=yes
PEERDNS=yes
PEERROUTES=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=no
NAME=MyCompany
UUID=f79848ff-11a6-4810-9e1a-99039dea84c4
ONBOOT=yes

Bridge and bridge port configuration:
ifcfg-bridge:                                ifcfg-bridge-port:
NAME=bridge                                  NAME=bridge007-port-eth0
UUID=4be99ce0-c5b2-4764-8b77-ec226e440125    UUID=3ad56c4a-47e1-419b-b0d4-8ad86eb967a3
DEVICE=bridge007                             DEVICE=eth0
STP=yes                                      ONBOOT=yes
TYPE=Bridge                                  TYPE=Ethernet
BRIDGING_OPTS=priority=32768                 BRIDGE=bridge007
ONBOOT=yes
BOOTPROTO=dhcp

Bonding configuration:
ifcfg-BOND:                                  ifcfg-BOND-port:
NAME=BOND                                    NAME=BOND-port
UUID=b41888aa-924c-450c-b0f8-85a4f0a51b4a    UUID=9bb048e4-286a-4cc3-b104-007dbd20decb
DEVICE=bond100                               DEVICE=eth0
BONDING_OPTS="mode=balance-rr miimon=100"    ONBOOT=yes
TYPE=Bond                                    TYPE=Ethernet
BONDING_MASTER=yes                           MASTER=bond100
ONBOOT=yes                                   SLAVE=yes
BOOTPROTO=dhcp

Team and team port configuration:
ifcfg-my_team0:
DEVICE=team0
TEAM_CONFIG="{ \"device\": \"team0\", \"runner\": {\"name\": \"roundrobin\"}, \"ports\": {\"eth1\": {}, \"eth2\": {}} }"
DEVICETYPE=Team
BOOTPROTO=dhcp
NAME=team0-profile
UUID=1d3460a0-7b37-457f-a300-fe8d92da4807
ONBOOT=yes

ifcfg-my_team0_port1:
NAME=team0-port1
UUID=d5aed298-c567-4cc1-b808-6d38ecef9e64
DEVICE=eth1
ONBOOT=yes
TEAM_MASTER=team0
DEVICETYPE=TeamPort

ifcfg-my_team0_port2:
NAME=team0-port2
UUID=94e75f4e-e5ad-401c-8962-31e0ae5d2215
DEVICE=eth2
ONBOOT=yes
TEAM_MASTER=team0
DEVICETYPE=TeamPort

The UUID values in the config files must be unique — no cap. You can use the uuidgen command line tool to generate such values. Alternatively, you can leave out UUID entirely. In that case NetworkManager will generate a UUID based on the file name. icon behavior honestly 🫶

🌸 DIFFERENCES AGAINST INITSCRIPTS 🌸

The main differences of NetworkManager ifcfg-rh plugin and traditional initscripts are:

  • NM_CONTROLLED=yes|no NM_CONTROLLED is a NetworkManager-specific variable used by NetworkManager for determining whether the device of the ifcfg file should be managed. NM_CONTROLLED=yes is supposed if the variable is not present in the file. Note that if you have more ifcfg files for a single device, NM_CONTROLLED=no in one of the files will cause the device not to be managed. The profile may not even be the active one. 💀
  • New variables NetworkManager has introduced some new variable, not present in initscripts, to be able to store data for its new features. The variables are marked as extensions in the tables below.
  • Semantic change of variables and differences NetworkManager changes the semantics for a few variables and there are other behavioral differences. 👀
    • PEERDNS — initscripts interpret PEERDNS=no to mean "never touch resolv.conf". NetworkManager interprets it to say "never add automatic (DHCP, PPP, VPN, etc.) nameservers to resolv.conf".
    • ONBOOT — initscripts use ONBOOT=yes to mark the devices that are to be activated during boot. NetworkManager extends this to also mean that this profile can be used for auto-connecting at any time.
    • BOOTPROTO — NetworkManager supports traditional values none (static), dhcp. But it also allows additional values to enable new addressing methods. They are autoip for IPv4 link-local addressing using Avahi daemon and shared for connection sharing. When shared is used, NetworkManager assigns the interface 10.42.0.1, or it uses the first static address, if configured.
    • HWADDR — initscripts compare the currently set hardware address of a device, while NetworkManager considers the permanent one.
    • NOZEROCONF — initscripts add an on-link route to 169.254.0.0/16 for ethernet profiles that don't explicitly opt-out by setting NOZEROCONF variable. NetworkManager does not do that. Instead a static, manual route with scope=253 (link) should be added to get that behavior.

See the next section for detailed mapping of NetworkManager properties and ifcfg-rh variables. Variable names, format and usage differences in NetworkManager and initscripts are documented in the tables below. 📋

👑 DETAILS 👑

ifcfg-rh plugin variables marked with (+) are NetworkManager specific extensions not understood by traditional initscripts. iykyk 💅

the 802-11-wireless setting 🦋✨

okay bestie, this is the Wi-Fi one, the main character of the whole page. each property gets its ifcfg-rh variable, its default, and the tea ☕

  • ssid → variable ESSID — the SSID of the Wi-Fi network. default: none listed. example, fr fr:
ESSID="Quick Net"
  • mode → variable MODE — the Wi-Fi network mode. no default listed. allowed values: Ad-Hoc, Managed (Auto), and yes it's case insensitive so don't stress about the caps 💅
  • band → variable BAND(+) — lowkey a whole situation: BAND alone is honored, but CHANNEL overrides BAND since it implies a band. so if you set both, channel wins, iykyk. example:
BAND=bg

allowed values: a, bg

  • channel → variable CHANNEL — the channel used for the Wi-Fi communication. no default listed. the vibe check here: channels greater than 14 mean "a" band, otherwise the band is "bg". that's just how it is 🎀 example:
CHANNEL=6
  • bssid → variable BSSID(+) — restricts association only to a single AP. like, it will only talk to that one access point, no mingling 💀 example:
BSSID=00:1E:BD:64:83:21
  • rate → variable (none) — > this property is deprecated and not handled by the ifcfg-rh plugin. so like… it's giving legacy, don't bother 🙈
  • tx-power → variable (none) — > also deprecated and not handled by the ifcfg-rh plugin. same energy, skip it ✨
  • mac-address → variable HWADDR — the hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05). no default listed. and here's the part you actually need to know: for initscripts this is the current MAC address of the device as found during ifup. for NetworkManager this is the permanent MAC address. or, in case no permanent MAC address exists, the MAC address

...and that description wrapped up with: initially configured on the device. Cool, cool — moving right along through the wireless properties, bestie 💖

  • cloned-mac-address → MACADDR — the cloned (aka spoofed, aka your-other-identity) MAC address, written out in the traditional hex-digits-and-colons notation, like 00:22:68:14:5A:99. Yes, exactly like that. 🎭
  • generate-mac-address-mask → GENERATE_MAC_ADDRESS_MASK(+) — the MAC address mask used for generating a randomized and stable cloned-mac-address. It's the stencil, basically. 🖌️
  • mac-address-blacklist → HWADDR_BLACKLIST(+) — it denies usage of the connection for any device whose address is listed. Rude, but effective. 🚫
  • mac-address-denylist → HWADDR_BLACKLIST(+) — same energy, same variable: it denies usage of the connection for any device whose address is listed. (Yes, mac-address-denylist and mac-address-blacklist both map to HWADDR_BLACKLIST(+) — twins fr fr 👯)
  • seen-bssids → (none) — okay so this one is a whole mood: it is not a regular property that would be configured by the user, and it is not handled by the ifcfg-rh plugin. So like... don't. 🙈
  • mtu → MTU — the MTU of the wireless interface. Simple, iconic, does its job. 📏
  • hidden → SSID_HIDDEN(+) — whether the network hides the SSID. Sneaky network energy. 🕵️‍♀️
  • powersave → POWERSAVE(+) — turns Wi-Fi power saving on or off.

Example:

POWERSAVE=enable

Allowed values: default, ignore, enable, disable. 🔋

  • mac-address-randomization → MAC_ADDRESS_RANDOMIZATION(+) — enables or disables Wi-Fi MAC address randomization.

Example:

MAC_ADDRESS_RANDOMIZATION=always

Allowed values: default, never, always. 🎲

  • ap-isolation → AP_ISOLATION(+) — whether AP isolation is enabled. Heads up: a missing variable means the global default applies.

Allowed values: "yes", "no". 🛡️

🎀 Table 2. 802-11-wireless-security setting 🎀

okay bestie this is the big one — the security table. every wifi password, every cipher, every "wait why isn't my laptop connecting" moment lives here. bookmark it fr fr 💅

  • key-mgmt — ifcfg-rh variable: KEY_MGMT(+). No default set. Key management method. Allowed values: none, ieee8021x, owe, wpa-psk, sae, wpa-eap, wpa-eap-suite-b-192.
  • wep-tx-keyidx — ifcfg-rh variable: DEFAULTKEY. Default: 1. Index of the active WEP key. 🌸 Big heads-up here: in ifcfg format the index starts counting at 1, while the NetworkManager API is otherwise zero based. so like… yes, that one-off is gonna bite you, iykyk 😭 Allowed values: 1, 2, 3, 4.
  • auth-alg — ifcfg-rh variable: SECURITYMODE(+). No default set. Authentication algorithm for WEP. Allowed values: restricted, open, leap.
  • proto — ifcfg-rh variables: WPA_ALLOW_WPA(+), WPA_ALLOW_WPA2(+). Default: no. Allowed WPA protocols, WPA and WPA2 (RSN). Allowed values: yes, no.
  • pairwise — ifcfg-rh variable: CIPHER_PAIRWISE(+). No default set. Restrict pairwise encryption algorithms, specified as a space separated list. Allowed values: CCMP, TKIP.
  • group — ifcfg-rh variable: CIPHER_GROUP(+). No default set. Restrict group/broadcast encryption algorithms, specified as a space separated list. Allowed values: CCMP, TKIP, WEP40, WEP104.
  • pmf — ifcfg-rh variable: PMF(+). No default set. Enables or disables PMF (802.11w). ✨ Example:
PMF=required

Allowed values: default, disable, optional, required.

  • leap-username — ifcfg-rh variable: IEEE_8021X_IDENTITY(+). No default set. Login name for LEAP. 🫶
  • wep-key0 — ifcfg-rh variables: KEY1, KEY_PASSPHRASE1(+). No default set. The first WEP key — and yes she's the one used in most networks, she's the main character here 👑. See also DEFAULTKEY for the key index.
  • wep-key1 — ifcfg-rh variables: KEY2, KEY_PASSPHRASE2(+). No default set. WEP key with index 1. See also DEFAULTKEY for the key index.
  • wep-key2 — writes to KEY3, KEY_PASSPHRASE3(+) — the WEP key with index 2 💅 and yeah, peep DEFAULTKEY for the key index.
  • wep-key3 — writes to KEY4, KEY_PASSPHRASE4(+) — the WEP key with index 3, bestie. Again, DEFAULTKEY handles the key index.
  • wep-key-flags — writes to WEP_KEY_FLAGS(+) — password flags for the KEY<i> / KEY_PASSPHRASE<i> password (the section called “Secret flags” has the whole _FLAGS values breakdown, iykyk).
  • psk — writes to WPA_PSK — the Pre-Shared-Key for WPA networks 🔐
  • psk-flags — writes to WPA_PSK_FLAGS(+) — password flags for WPA_PSK_FLAGS (again, section called “Secret flags” for _FLAGS values).

Example:

WPA_PSK_FLAGS=user
  • leap-password — writes to IEEE_8021X_PASSWORD(+) — the password for LEAP. It can also go to the "key-" lookaside file, or it can be owned by a secret agent 🕵️‍♀️
  • leap-password-flags — writes to IEEE_8021X_PASSWORD_FLAGS(+) — password flags for IEEE_8021X_PASSWORD_FLAGS (see the section called “Secret flags” for _FLAGS values).
  • wep-key-type — writes to KEY<i> or KEY_PASSPHRASE<i>(+), plus KEY_TYPE(+) — okay so here's the tea ☕ KEY is used for the "key" type (10 or 26 hexadecimal characters, or a 5 or 13 character string prefixed with "s:"). KEY_PASSPHRASE is used for WEP passphrases. KEY_TYPE specifies the key type and can be either 'key' or 'passphrase'. KEY_TYPE is redundant and can be omitted, so don't stress it.

Example:

KEY1=s:ahoj, KEY1=0a1c45bc02, KEY_PASSPHRASE1=mysupersecretkey
  • wps-method — writes to WPS_METHOD — used to control the WPS methods to be used. Valid values are "default", "auto", "disabled", "pin" and "pbc". If it's omitted, whatever the AP announces is used ✨

Example:

WPS_METHOD=disabled, WPS_METHOD="pin pbc"
  • fils — writes to FILS(+) — enables or disables FILS (802.11ai) 🦋

Example:

FILS=required

Allowed values: default, disable, optional, required.

✨ Table 3. 802-1x setting ✨

okay bestie, this is the 802-1X table but make it a bullet list so nobody’s eyes glaze over 💅 the Default column is literally empty for every single row in the original, so every bullet says (blank) and we keep it moving. no cap.

  • eap — ifcfg-rh variable: IEEE_8021X_EAP_METHODS(+). Default: (blank). EAP method for 802.1X authentication. Example: IEEE_8021X_EAP_METHODS=PEAP

Allowed values: "LEAP", "PWD", "TLS", "PEAP", "TTLS", "FAST"

  • identity — ifcfg-rh variable: IEEE_8021X_IDENTITY(+). Default: (blank). Identity for EAP authentication methods. Example: IEEE_8021X_IDENTITY=itsme
  • anonymous-identity — ifcfg-rh variable: IEEE_8021X_ANON_IDENTITY(+). Default: (blank). Anonymous identity for EAP authentication methods.
  • pac-file — ifcfg-rh variable: IEEE_8021X_PAC_FILE(+). Default: (blank). File with PAC (Protected Access Credential) for EAP-FAST. Example: IEEE_8021X_PAC_FILE=/home/joe/my-fast.pac
  • ca-cert — ifcfg-rh variable: IEEE_8021X_CA_CERT(+). Default: (blank). CA certificate for EAP. Example: IEEE_8021X_CA_CERT=/home/joe/cacert.crt
  • ca-path — ifcfg-rh variable: IEEE_8021X_CA_PATH(+). Default: (blank). The search path for the certificate.
  • subject-match — ifcfg-rh variable: IEEE_8021X_SUBJECT_MATCH(+). Default: (blank). Substring to match subject of server certificate against. Example: IEEE_8021X_SUBJECT_MATCH="Red Hat"
  • altsubject-matches — ifcfg-rh variable: IEEE_8021X_ALTSUBJECT_MATCHES(+). Default: (blank). List of strings to be matched against the altSubjectName. Example: IEEE_8021X_ALTSUBJECT_MATCHES="s1.domain.cc"
  • domain-suffix-match — ifcfg-rh variable: IEEE_8021X_DOMAIN_SUFFIX_MATCH(+). Default: (blank). Suffix to match domain of server certificate against.
  • domain-match — maps to the env var IEEE_8021X_DOMAIN_MATCH(+). No default listed. It's the value we match the domain of the server certificate against. iykyk, cert validation is the moment 💅
  • client-cert — maps to IEEE_8021X_CLIENT_CERT(+). No default listed. This is your client certificate for EAP, bestie.

Example:

IEEE_8021X_CLIENT_CERT=/home/joe/mycert.crt
  • phase1-peapver — maps to IEEE_8021X_PEAP_VERSION(+). No default listed. Use it to force a specific PEAP version.

Allowed values: 0, 1

  • phase1-peaplabel — maps to IEEE_8021X_PEAP_FORCE_NEW_LABEL(+), and the default is no. Use it to force the new PEAP label during key derivation.

Allowed values: yes, no

  • phase1-fast-provisioning — maps to IEEE_8021X_FAST_PROVISIONING(+). No default listed. Turns on in-line provisioning of EAP-FAST credentials. lowkey niche but slay ✨

Example:

IEEE_8021X_FAST_PROVISIONING="allow-auth allow-unauth"

Allowed values: a space-separated list of these values [allow-auth, allow-unauth]

  • phase1-auth-flags — maps to IEEE_8021X_PHASE1_AUTH_FLAGS(+). No default listed. These are the authentication flags for the supplicant 🎀

Example:

IEEE_8021X_PHASE1_AUTH_FLAGS="tls-1-0-disable tls-1-1-disable"

Allowed values: a space-separated list of authentication flag names

  • phase2-auth — maps to IEEE_8021X_INNER_AUTH_METHODS(+). No default listed. It's the inner non-EAP authentication methods for TTLS, or the inner EAP authentication method for PEAP. And heads up: IEEE_8021X_INNER_AUTH_METHODS can contain values for both 'phase2-auth' and 'phase2-autheap' properties — they share, it's giving sharing-is-caring 🫶

Example:

IEEE_8021X_INNER_AUTH_METHODS=PAP

Allowed values: "PAP", "CHAP", "MSCHAP", "MSCHAPV2", "GTC", "OTP", "MD5" and "TLS"

  • phase2-autheap — maps to IEEE_8021X_INNER_AUTH_METHODS(+) too. No default listed. This is the inner EAP-based authentication methods. Note that IEEE_8021X_INNER_AUTH_METHODS is also used for 'phase2-auth' values — same variable, wearing two hats 👑

Example:

IEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP-TLS"

Allowed values: "EAP-MD5", "EAP-MSCHAPV2", "EAP-GTC", "EAP-OTP" and "EAP-TLS"

  • phase2-ca-path → IEEE_8021X_PHASE2_CA_PATH(+) — literally just the search path for the certificate. that's it, that's the whole vibe ✨
  • phase2-subject-match → IEEE_8021X_PHASE2_SUBJECT_MATCH(+) — a substring you match the subject of the server certificate against. like a little grep but for certs, iykyk.

Example: IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat"

  • phase2-altsubject-matches → IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES(+) — okay so the manual gives this one zero description. blank. empty. the void 💀 no cap, that's genuinely all it says, so i'm not gonna sit here and make something up.
  • phase2-domain-suffix-match → IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH(+) — the suffix you match the domain of the server certificate for phase 2 against 🎀
  • phase2-domain-match → IEEE_8021X_PHASE2_DOMAIN_MATCH(+) — the value you match the domain of the server certificate for phase 2 against. (yes bestie, -suffix-match and -match are two different things, don't @ me)
  • phase2-client-cert → IEEE_8021X_INNER_CLIENT_CERT(+) — the client certificate for the inner EAP method 🔐

Example: IEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert.crt

  • password → IEEE_8021X_PASSWORD(+) — a UTF-8 encoded password used for EAP. it can also go to the "key-" lookaside file, or it can be owned by a secret agent 🕵️‍♀️ very main character energy honestly
  • password-flags → IEEE_8021X_PASSWORD_FLAGS(+) — password flags for the IEEE_8021X_PASSWORD password. (peep the section called “Secret flags” for the _FLAGS values 👀)
  • password-raw → IEEE_8021X_PASSWORD_RAW(+) — password used for EAP, but encoded as a hexadecimal string. it can also go to the "key-" lookaside file.

Example: IEEE_8021X_PASSWORD_RAW=041c8320083aa4bf

  • password-raw-flags → IEEE_8021X_PASSWORD_RAW_FLAGS(+) — the secret flags for password-raw. short and sweet 🍓
  • private-key → IEEE_8021X_PRIVATE_KEY(+) — the private key for EAP-TLS 🔑

Example: IEEE_8021X_PRIVATE_KEY=/home/joe/mykey.p12

  • private-key-password → IEEE_8021X_PRIVATE_KEY_PASSWORD(+) — the password for IEEE_8021X_PRIVATE_KEY. it can also go to the "key-" lookaside file, or it can be owned by a secret agent. (same deal as the other passwords, the secret-agent thing is very iconic of it)
  • private-key-password-flags → IEEE_8021X_PRIVATE_KEY_PASSWORD_FLAGS(+) — password flags for the IEEE_8021X_PRIVATE_KEY_PASSWORD password. (again — the section called “Secret flags” has your _FLAGS values 💅)
  • phase2-private-key → IEEE_8021X_INNER_PRIVATE_KEY(+) — the private key for the inner authentication method when you're doing EAP-TLS 💖 like, the actual secret key material, bestie, handle with care.
  • phase2-private-key-password → IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD(+) — the password for IEEE_8021X_INNER_PRIVATE_KEY. It can also live in a "key-" lookaside file, or it can be owned by a secret agent 👑 (yes, that's really what it's called — very spy-core).
  • phase2-private-key-password-flags → IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS(+) — the password flags for the IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password. For the _FLAGS values, go see the section called “Secret flags” 🫶.
  • pin → IEEE_8021X_PIN(+) — the pin secret used for EAP authentication methods 🔐.
  • pin-flags → IEEE_8021X_PIN_FLAGS(+) — the secret flags for the pin property.
  • system-ca-certs → IEEE_8021X_SYSTEM_CA_CERTS(+) — a boolean value ✨ (that's the whole description, icon, she's brief).
  • auth-timeout → IEEE_8021X_AUTH_TIMEOUT(+) — default 0. Timeout in seconds for the 802.1X authentication. Zero means the global default or 25 ⏳ so like, 0 isn't "no timeout", it's "whatever the global default says, or 25 if that's not a thing."
  • optional → IEEE_8021X_OPTIONAL(+) default=no — whether the 802.1X authentication is optional 🌸.
  • openssl-ciphers → IEEE_8021X_OPENSSL_CIPHERS(+) — cipher string for the TLS setup of wpa_supplicant 🎀.

🎀 Table 4. 802-3-ethernet setting 🎀

okay bestie, this is the ethernet table and honestly? it's giving very much "here's what the plugin will and won't save for you" energy. one column is the property, one's the ifcfg-rh variable, one's the default, one's the description. the default column is empty for every single one of these, btw — not me pointing that out, it's just literally the truth 💅

  • port — ifcfg-rh variable: (none). Default: (empty). The property is not saved by the plugin. that's it, that's the whole story, no cap 🙈
  • speed — ifcfg-rh variable: ETHTOOL_OPTS. Default: (empty). Fixed speed for the ethernet link. It is added as "speed" parameter in the ETHTOOL_OPTS variable.
  • duplex — ifcfg-rh variable: ETHTOOL_OPTS. Default: (empty). Fixed duplex mode for the ethernet link. It is added as "duplex" parameter in the ETHOOL_OPTS variable.
not me double-checking the spelling — yep, it says ETHOOL_OPTS right there in the original, so we're keeping it exactly like that 💀
  • auto-negotiate — ifcfg-rh variable: ETHTOOL_OPTS. Default: (empty). Whether link speed and duplex autonegotiation is enabled. It is not saved only if disabled and no values are provided for the "speed" and "duplex" parameters (skips link configuration).
  • mac-address — ifcfg-rh variable: HWADDR. Default: (empty). Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05). Note that for initscripts this is the current MAC address of the device as found during ifup. For NetworkManager this is the permanent MAC address. Or in case no permanent MAC address exists, the MAC address initially configured on the device. 🦋
  • cloned-mac-address — ifcfg-rh variable: MACADDR. Default: (empty). Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99). yes she's wearing a little disguise ✨
  • generate-mac-address-mask — ifcfg-rh variable: GENERATE_MAC_ADDRESS_MASK(+). Default: (empty). the MAC address mask for generating randomized and stable cloned-mac-address.
  • mac-address-blacklist — ifcfg-rh variable: HWADDR_BLACKLIST(+). Default: (empty). It denies usage of
  • HWADDR_BLACKLIST — okay so this row is the continuation of the table, and it's doing the exact same flex: it denies usage of the connection for any device whose address is listed, which is giving bouncer-at-the-club energy 💅

Example:

HWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55"
  • mac-address-denylist → HWADDR_BLACKLIST(+) — not a repeat bestie, it's the actual property row with the little (+) on the variable name (yes that's part of it, don't @ me). It denies usage of the connection for any device whose address is listed. Same vibe, same syntax:
HWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55"
  • mtu → MTU — literally just the MTU of the interface. Short king. 🫶
  • s390-subchannels → SUBCHANNELS — subchannels for IBM S390 hosts. Mainframe girlies stay winning 👑

Example:

SUBCHANNELS=0.0.b00a,0.0.b00b,0.0.b00c
  • s390-nettype → NETTYPE — the network type of the S390 host. 🌈

Example:

NETTYPE=qeth

Allowed values: "qeth", "lcs" or "ctc" — that's the whole menu, no secret options, no cap.

  • s390-options → OPTIONS and PORTNAME, CTCPROTO — S390 device options. The tea here: all options go to OPTIONS, except for "portname" and "ctcprot" which get to be special little main characters with their own variables. 🎀
  • wake-on-lan → ETHTOOL_OPTS, ETHTOOL_WAKE_ON_LAN — Wake on Lan mode for ethernet. Get this: the setting "ignore" is expressed with "ETHTOOL_WAKE_ON_LAN=ignore". Every other case, the "ETHTOOL_OPTS" variable gets set with the value "wol" plus several of the characters "p|u|m|b|a|g|s|f|d" — and those bad boys are as explained in the ethtool manual page, so go read that one too, iykyk 📖
  • wake-on-lan-password → ETHTOOL_OPTS — the password for secure-on based Wake-on-Lan. It gets added as the "sopass" parameter inside the ETHTOOL_OPTS variable. 🔐

Example:

ETHTOOL_OPTS="wol gs sopass 00:11:22:33:44:55"
  • accept-all-mac-addresses → ACCEPT_ALL_MAC_ADDRESSES — this one enforces the interface to accept all the packets. No filtering, no picking favourites, just vibes accepting everything 💀

🌸 Table 5. bond setting 🌸

  • options → BONDING_OPTS — bonding options. That's it, that's the whole property, and it carries the entire personality of the bond ✨

Example:

BONDING_OPTS="miimon=100 mode=broadcast"

🦋 Table 6. bond-port setting 🦋

  • queue-id → BOND_PORT_QUEUE_ID(+) — queue ID, and it defaults to 0 because of course it does. The (+) is chillin' on the variable name again.

Allowed values: 0 - 65535

  • prio → BOND_PORT_PRIO(+) — port priority, also defaulting to 0. Let them be equal, it's fine, it's a whole thing.

Allowed values: -2147483648 - 2147483647 — yes those are real numbers, yes they're huge, no I will not be counting that high manually 😭

💅 Table 7. bridge setting 💅

okay bestie, this is the bridge table and it's lowkey the main character of the bridge config ✨ Every property, every ifcfg-rh variable, every default — it's all here, no cap 🫶

  • mac-address — ifcfg-rh variable: BRIDGE_MACADDR(+) · default: (blank in the table, so nothing's pre-set) — this is the MAC address of the bridge 🌸 Heads up though: it requires a recent kernel support, originally introduced in 3.15 upstream kernel. And fyi, BRIDGE_MACADDR for bridges is an NM extension, so it's not your standard-issue ifcfg thing, iykyk 👑
  • stp — ifcfg-rh variable: STP · default: no — span tree protocol participation 🎀 yes, that's exactly how the manpage says it, "span tree", we're keeping it fr fr. Default is no so STP is off unless you say otherwise.
  • priority — ifcfg-rh variable: BRIDGING_OPTS: priority= · default: 32768 — the STP priority 💜 allowed values: 0 - 32768. That's the whole range, bestie, it's giving "anything goes" energy.
  • forward-delay — ifcfg-rh variable: DELAY · default: 15 — STP forwarding delay ⭐ allowed values: 2 - 30. Note this one's plain DELAY, not a BRIDGING_OPTS key — she's ✨special✨.
  • hello-time — ifcfg-rh variable: BRIDGING_OPTS: hello_time= · default: 2 — STP hello time 👋 allowed values: 1 - 10.
  • max-age — ifcfg-rh variable: BRIDGING_OPTS: max_age= · default: 20 — STP maximum message age 🕰️ allowed values: 6 - 40.
  • ageing-time — ifcfg-rh variable: BRIDGING_OPTS: ageing_time= · default: 300 — Ethernet MAC ageing time 🍓 allowed values: 0 - 1000000. Yes, up to a million, she said what she said 💀
  • multicast-snooping — ifcfg-rh variable: BRIDGING_OPTS: multicast_snooping= · default: 1 — IGMP snooping support 🦋 allowed values: 0 or 1. It's a little on/off moment, adorable honestly.
  • vlan-filtering — ifcfg-rh variable: BRIDGING_OPTS: vlan_filtering= · default: 0 — VLAN filtering support 🌈 (and that's where the table cuts off in our copy, so we're not gonna sit here and invent an allowed-values list — that would be fake news 🙈)
finishing the last one from up top, real quick: its allowed values are 0 or 1 — that's it, that's the whole vibe check 🎀
  • vlan-default-pvid — the default VLAN PVID for the bridge, bestie. Under the hood it's BRIDGING_OPTS: default_pvid= and it ships with a default of 1.
    • allowed values: 0 - 4094
  • vlans — literally just the list of VLANs on the bridge 🌈 this one lives in BRIDGE_VLANS, no BRIDGING_OPTS wrapper, she's different like that. No default listed.
    • example:
BRIDGE_VLANS="1 pvid untagged,20,300-400 untagged"
  • group-address — the STP group address 👑 set via BRIDGING_OPTS: group_address=. No default in the table.
    • example:
BRIDGING_OPTS="group_address=01:80:C2:00:00:0A"
  • vlan-protocol — the VLAN filtering protocol ✨ via BRIDGING_OPTS: vlan_protocol=. No default given.
    • example:
BRIDGING_OPTS="vlan_protocol=802.1Q"
  • vlan-stats-enabled — the VLAN stats toggle 🦋 BRIDGING_OPTS: vlan_stats_enabled=, default 0.
    • example:
BRIDGING_OPTS="vlan_stats_enabled=1"
  • multicast-router — the multicast router setting 💜 BRIDGING_OPTS: multicast_router=, and it defaults to auto (she picks for you, main character energy).
    • example:
BRIDGING_OPTS="multicast_router=enabled"
  • allowed values: auto, enabled, disabled
  • multicast-query-use-ifaddr — BRIDGING_OPTS: multicast_query_use_ifaddr=, default 0. Ngl the example below keeps the dash in the key exactly like the page has it, so don't come for me 🙈
    • example:
BRIDGING_OPTS="multicast_query-use_ifaddr=1"
  • multicast-querier — the multicast querier flag 🌸 BRIDGING_OPTS: multicast_querier=, default 0.
    • example:
BRIDGING_OPTS="multicast_querier=1"
  • multicast-hash-max — the max multicast hash 💅 BRIDGING_OPTS: multicast_hash_max=, default 4096.
    • example:
BRIDGING_OPTS="multicast_hash_max=8192"
  • multicast-last-member-count — how many last members we're counting, lowkey iconic 🍓 BRIDGING_OPTS: multicast_last_member_count=, default 2.
    • example:
BRIDGING_OPTS="multicast_last_member_count=4"
  • multicast-last-member-interval — lives in BRIDGING_OPTS as multicast_last_member_interval=, default is 100. 💅

Example:

BRIDGING_OPTS="multicast_last_member_interval=200"
  • multicast-membership-interval — goes in BRIDGING_OPTS as multicast_membership_interval=, default is 26000.

Example:

BRIDGING_OPTS="multicast_membership_interval=16000"
  • multicast-querier-interval — BRIDGING_OPTS girlie, key is multicast_querier_interval=, default 25500. ✨

Example:

BRIDGING_OPTS="multicast_querier_interval=20000"
  • multicast-query-interval — yep, BRIDGING_OPTS: multicast_query_interval=, default 12500.

Example:

BRIDGING_OPTS="multicast_query_interval=22500"
  • multicast-query-response-interval — BRIDGING_OPTS: multicast_query_response_interval=, default 1000. 🎀

Example:

BRIDGING_OPTS="multicast_query_response_interval=2000"
  • multicast-startup-query-count — BRIDGING_OPTS: multicast_startup_query_count=, default 2.

Example:

BRIDGING_OPTS="multicast_startup_query_count=4"
  • multicast-startup-query-interval — BRIDGING_OPTS: multicast_startup_query_interval=, default 3125. 🦋

Example:

BRIDGING_OPTS="multicast_startup_query_interval=4000"

🌈 Table 8. bridge-port setting 🌈

okay bestie this one's all about the individual ports on your bridge, and it's giving very main character energy honestly 👑

  • priority — set via BRIDGING_OPTS: priority=, default is 32. It's the STP priority. Allowed values: 0 - 63. lowkey a tiny range but she said what she said 💅
  • path-cost — set via BRIDGING_OPTS: path_cost=, default is 100. That's the STP cost. Allowed values: 1 - 65535. way more room to play in here fr fr 🔥
  • hairpin-mode — set via BRIDGING_OPTS: hairpin_mode=, default is yes. It's the hairpin mode of the bridge port. cute name, serious job 🎀
  • vlans — this one's special, it uses the BRIDGE_PORT_VLANS variable (not BRIDGING_OPTS, ik ik, plot twist 🙈). It's the list of VLANs on the bridge port.

Example:

BRIDGE_PORT_VLANS="1 pvid untagged,20,300-400 untagged"
ngl that VLAN example is doing a lot — 1 pvid untagged, then 20, then the range 300-400 untagged, all comma-separated. copy it exactly, don't get creative with the commas or the spaces or the universe will humble you 😭

✨ Table 9. connection setting ✨

Okay bestie, this is the connection table — the big one where every NetworkManager property gets matched up with its ifcfg-rh variable. Three columns of truth: the Property, the Ifcfg-rh Variable it lives in, and its Default. Plus a description, obviously. Let's go row by row 🫶

  • id — ifcfg-rh variable: NAME(+) · default: none — the user friendly name for the connection profile. That's the cute little label you actually recognise it by 💖
  • uuid — ifcfg-rh variable: UUID(+) · default: none — the UUID for the connection profile. And here's the fun part: when it's missing, NetworkManager just goes ahead and creates the UUID by hashing the connection filename. Iconic lazy-girl behaviour, honestly ✨
  • stable-id — ifcfg-rh variable: STABLE_ID(+) · default: none — the token used to generate stable IDs. That's it, that's the whole vibe 🎀
  • interface-name — ifcfg-rh variable: DEVICE · default: none — the interface name of the device this profile is bound to. You can literally leave the variable out when the profile should apply for more devices, no big deal. But heads up: DEVICE can be required for some connection types 👀 so don't just ghost it unconditionally.
  • type — ifcfg-rh variables: TYPE (also DEVICETYPE, DEVICE) · default: none — the base type of the connection. DEVICETYPE is the one used for teaming connections, iykyk.

Examples, verbatim, because yes:

TYPE=Ethernet;
TYPE=Bond;
TYPE=Bridge;
DEVICETYPE=TeamPort

Allowed values are: Ethernet, Wireless, InfiniBand, Bridge, Bond, Vlan, Team, TeamPort. Pick from the list, don't freestyle 💅

  • permissions — ifcfg-rh variable: USERS(+) · default: none — restricts access to this connection to certain users, and only lets the connection be active when at least one of those specified users is logged into an active session. So it's like a VIP list but for your network profile 🌸

Example:

USERS="joe bob"
  • autoconnect — ifcfg-rh variable: ONBOOT · default: yes — whether the connection should be autoconnected (not only while
  • autoconnect-priority / AUTOCONNECT_PRIORITY(+) — default is 0. This is the connection priority for automatic activation ✨ and the way it works is genuinely so simple: connections with higher numbers are preferred when NetworkManager is picking profiles for automatic activation. That's it, that's the whole vibe — bigger number, more main character energy. 💅

Example:

AUTOCONNECT_PRIORITY=20

Allowed values: -999 to 999.

  • autoconnect-retries / AUTOCONNECT_RETRIES(+) — no default listed, so it just does its thing 🙈. This one is literally "the number of times a connection should be autoactivated before giving up and switching to the next one" — like, how many chances does this profile get before we move on? Bestie, we've all been there 😭

Example:

AUTOCONNECT_RETRIES=1

Allowed values: -1 (use global default), 0 (forever) or a positive value.

  • multi-connect / MULTI_CONNECT(+) — no default shown. This is about "whether the profile can be active on multiple devices at a given moment" 👀 i.e. can this profile be everywhere at once, multitasking queen that she is. The values are numbers corresponding to the #NMConnectionMultiConnect enum — so yes, the numbers mean something specific, go look at the enum, iykyk 🧚

Example:

MULTI_CONNECT=3
  • zone / ZONE(+) — no default. The trust level of this connection 🛡️ The string is usually used for a firewall. Very "who gets to sit at my table" energy, ngl.

Example:

ZONE=Work
  • master / MASTER, MASTER_UUID, TEAM_MASTER, TEAM_MASTER_UUID, BRIDGE, BRIDGE_UUID — no default. A reference to the controller connection 👑 The variable used depends on the connection type and the value. In general, if the *_UUID variant is present, the variant without *_UUID is ignored ⚠️ — so don't be out here setting both and expecting the plain one to win, because she will not. NetworkManager attempts to write both for compatibility with legacy tooling 🫶 (yes, it's doing extra credit work so old tools don't break, iconic behaviour honestly).
  • slave-type / MASTER, MASTER_UUID, TEAM_MASTER, TEAM_MASTER_UUID, DEVICETYPE, BRIDGE, BRIDGE_UUID — no default. Okay so this one is a lil sneaky: slave type doesn't map directly to a variable, but it is recognized using different variables 💅 Here's the mapping, don't lose it:
    • MASTER and MASTER_UUID → for bonding
    • TEAM_MASTER, TEAM_MASTER_UUID and DEVICETYPE → for teaming
    • BRIDGE and BRIDGE_UUID → for bridging
  • autoconnect-slaves / AUTOCONNECT_SLAVES(+) — default is literally missing variable means global 🌈 (so if it's not there, it falls back to the global setting — no variable, no opinion, just vibes from above). Whether slaves of this connection should be…
  • (the row that got sliced at the page break — finishing it off) — its default is just an empty slot, and it gets auto-connected when this connection is activated. 🫶
  • secondaries → SECONDARY_UUIDS(+) — no default here 💅 — this one's the UUID of VPN connections that should be activated together with this connection. Squad goals, but make it networking. 🦋
  • gateway-ping-timeout → GATEWAY_PING_TIMEOUT(+) — default is 0 — if it's greater than zero, your IP connectivity gets checked by pinging the gateway and waiting for the specified timeout (in seconds). so like, a vibe check but for your route. 📡

Example, bestie:

GATEWAY_PING_TIMEOUT=5
  • metered → CONNECTION_METERED(+) — no default listed — tells you whether the device is metered (iykyk if you've ever been throttled 😭).

Example:

CONNECTION_METERED=yes

Allowed values: yes,no,unknown

  • lldp → LLDP(+) — here's the tea: a missing variable means global default 🌍 — otherwise it says whether LLDP is enabled for the connection.

Example: LLDP=no

Allowed values: boolean value or 'rx'

  • auth-retries → AUTH_RETRIES(+) — default 0 — the number of retries for authentication. that's it, that's the whole vibe. 🔁
  • mdns → MDNS(+) — again, missing variable means global default — this one's whether or not mDNS is enabled for the connection. ✨

Example: MDNS=yes

Allowed values: yes,no,resolve

  • llmnr → LLMNR(+) — same deal, missing variable means global default — whether or not LLMNR is enabled for the connection. 🎀

Example: LLMNR=yes

Allowed values: yes,no,resolve

  • dns-over-tls → DNS_OVER_TLS(+) — yep, missing variable means global default — says whether or not DNSOverTls is enabled for the connection. your DNS, but in a little TLS trench coat 🧥🔐

Allowed values: yes,no,opportunistic

  • mptcp-flags → MPTCP_FLAGS(+) — missing variable means global default, iconic behaviour — these are the MPTCP flags that indicate whether MPTCP is enabled and which flags to use for the address endpoints. 👑

Example:

MPTCP_FLAGS="signal,subflow"
  • wait-device-timeout → DEVTIMEOUT(+) — no default shown — description starts with for initscripts and keeps going on the next part, so hold that thought, we're not done with this row yet… ⏳🍓
  • devtimeout / DEVTIMEOUT — okay so because of compatibility, this variable has to be a whole integer, no cap. If it genuinely needs to, NetworkManager will also stash a fractional component for the milliseconds — so like, it's an integer on the surface but it's got layers 💅

Example:

DEVTIMEOUT=5

Allowed values: a timeout in seconds.

  • mud-url / MUD_URL — the MUD_URL that gets sent by the device (See RFC 8520) 🦋

Example:

https://yourdevice.example.com/model.json

Allowed values: a valid URL that points to the recommended policy for this device.

  • wait-activation-delay / WAIT_ACTIVATION_DELAY(+) — how long, in milliseconds, to wait for the connection to be considered activated. The waiting starts after the pre-up dispatcher event fires, so it's giving very much "hold on bestie, we're not there yet" energy ⏳

Example:

WAIT_ACTIVATION_DELAY=5000

Allowed values: a delay in milliseconds.

🎀 Table 10. dcb setting 🎀

okay bestie, this is the DCB table and it's giving ✨data center bridging✨ realness — every property, every ifcfg-rh variable, every default, all of it. no skipping, periodt.

app-fcoe-flags — iykyk, this one lives in not one, not two, but three variables: DCB_APP_FCOE_ENABLE, DCB_APP_FCOE_ADVERTISE, DCB_APP_FCOE_WILLING.

  • Default: no
  • What it is: FCOE flags. 💅
  • Example:
DCB_APP_FCOE_ENABLE=yes
DCB_APP_FCOE_ADVERTISE=yes

app-fcoe-priority — variable: DCB_APP_FCOE_PRIORITY. no default listed, so don't go assuming one 🙈

  • What it is: Priority of FCoE frames.
  • Allowed values: 0 - 7

app-fcoe-mode — variable: DCB_APP_FCOE_MODE.

  • Default: fabric
  • What it is: FCoE controller mode.
  • Allowed values: fabric, vn2vn

app-iscsi-flags — variables: DCB_APP_ISCSI_ENABLE, DCB_APP_ISCSI_ADVERTISE, DCB_APP_ISCSI_WILLING.

  • Default: no
  • What it is: iSCSI flags.

app-iscsi-priority — variable: DCB_APP_ISCSI_PRIORITY.

  • What it is: Priority of iSCSI frames.
  • Allowed values: 0 - 7

app-fip-flags — variables: DCB_APP_FIP_ENABLE, DCB_APP_FIP_ADVERTISE, DCB_APP_FIP_WILLING.

  • Default: no
  • What it is: FIP flags.

app-fip-priority — variable: DCB_APP_FIP_PRIORITY.

  • What it is: Priority of FIP frames.
  • Allowed values: 0 - 7

priority-flow-control-flags — variables: DCB_PFC_ENABLE, DCB_PFC_ADVERTISE, DCB_PFC_WILLING.

  • Default: no
  • What it is: Priority flow control flags.

priority-flow-control — variable: DCB_PFC_UP.

  • What it is: Priority flow control values. It's a string of 8 characters made of "0" and "1", where "0" means "do not transmit priority pause" and "1" means "transmit pause". 🫶
  • Example:
DCB_PFC_UP=01101110

priority-group-flags — variables: DCB_PG_ENABLE, DCB_PG_ADVERTISE, DCB_PG_WILLING.

  • Default: no
  • What it is: Priority groups flags.

priority-group-id — variable: DCB_PG_ID.

  • What it is: Priority groups values. It's a string of eight priorities (0 - 7) or "f" for unrestricted. 🦋
  • Example:
DCB_PG_ID=1205f173

priority-group-bandwidth — variable: DCB_PG_PCT.

  • What it is: Priority groups values — eight bandwidths (in percent), separated with commas.
  • Example:
DCB_PG_PCT=10,5,10,15,10,10,10,30

priority-bandwidth — variable: DCB_PG_UPPCT.

  • What it is: Priority values — eight bandwidths (in percent), separated with commas. ⚠️ and bestie, listen: the sum of the numbers must be 100. no cap, it's not a vibe if it doesn't add up 💀
  • Example:
DCB_PG_UPPCT=...
nope, no example given in the original for this row — just know it's eight comma-separated percents that sum to 100. ✨

…and that last row's Example field was still going, so real quick, here's how it ended:

       │                             │                          │         │ Example:                            │
       │                             │                          │         │ DCB_PG_UPPCT=7,13,10,10,15,15,10,20 │

Then the rest of the DCB crew: 💅

  • priority-strict-bandwidth — maps to DCB_PG_STRICT — no default listed. This one's about priority values, and it's a string of eight "0" or "1" characters, where "0" means "may not utilize all bandwidth" and "1" means "may utilize all bandwidth". 🎀
    • Example: DCB_PG_STRICT=01101110
  • priority-traffic-class — maps to DCB_PG_UP2TC — no default listed. Also priority values, but this time it's a string of eight traffic class values (0 - 7). ✨
    • Example: DCB_PG_UP2TC=01623701
Heads up bestie: all DCB related configuration is a NetworkManager extension. You must explicitly use DCB=yes to enable DCB so that the rest of the DCB_* variables can apply. Like, no DCB=yes, no party. 🫶

🦋 Table 11. ethtool setting

Okay so this one is literally just vibes — there are no rows listed for it in the source. It's giving "placeholder icon". 🙈 Same energy as the next one:

🧚 Table 12. geneve setting

Also empty. Just a caption, no content. Moving on, bestie 🎀

👑 Table 13. hostname setting

Now this table ate, fr fr. Four columns: Property, Ifcfg-rh Variable, Default, Description. ✨

  • priority — ifcfg-rh variable: HOSTNAME_PRIORITY(+) — Default: missing variable means global value or 100. Description: hostname priority. 🌸
    • Example: HOSTNAME_PRIORITY=50
  • from-dhcp — ifcfg-rh variable: HOSTNAME_FROM_DHCP(+) — Default: missing variable means global default or 1. Description: whether the system hostname can be determined from DHCP. 🔥
    • Example: HOSTNAME_FROM_DHCP=0,1
  • from-dns-lookup — ifcfg-rh variable: HOSTNAME_FROM_DNS_LOOKUP(+) — Default: missing variable means global default or 1. Description: whether the system hostname can be determined from reverse DNS lookup. 💫
    • Example: HOSTNAME_FROM_DNS_LOOKUP=0,1
  • only-best-device — ifcfg-rh variable: HOSTNAME_ONLY_FROM_DEFAULT(+) — Default: missing variable means global default or 1. Description: whether the hostname can be determined only from devices with the default route. 💜
    • Example: HOSTNAME_ONLY_FROM_DEFAULT=0,1

🌈 Table 14. hsr setting

(another caption with nothing under it — the suspense is killing me, ngl 😭)

✨ Table 15. infiniband setting ✨

Okay bestie, this one's all about InfiniBand — the fancy high-speed networking thing that's giving main character energy in your cluster 🫶 Here's every property, every variable, every default, and nobody gets left behind.

  • mac-address — the ifcfg-rh variable is HWADDR, and there's no default here. This is the IBoIP 20-byte hardware address of the device (in traditional hex-digits-and-colons notation). Heads up though, because the meaning lowkey shifts between tools: for initscripts this is the current MAC address of the device as found during ifup. For NetworkManager this is the permanent MAC address. Or, in case no permanent MAC address exists, the MAC address initially configured on the device. Literally important distinction, don't sleep on it 💅

Example:

HWADDR=01:02:03:04:05:06:07:08:09:0A:01:02:03:04:05:06:07:08:09:11
  • mtu — the ifcfg-rh variable is MTU, no default given. It's just the MTU of the interface. Simple, iconic, no notes 🌸
  • transport-mode — the ifcfg-rh variable is CONNECTED_MODE, and the default is CONNECTED_MODE=no. Set CONNECTED_MODE=yes for "connected" mode, and CONNECTED_MODE=no for "datagram" mode. Pick your vibe 🦋
  • p-key — the ifcfg-rh variable is PKEY_ID or PKEY_ID_NM() (this one *requires PKEY=yes), and the default is PKEY=no. This is the InfiniBand P_Key 💖

The value can be a hex number prefixed with "0x" or a decimal number. When PKEY_ID is specified, PHYSDEV must be specified — no skipping that, fr fr.

Note that the ifcfg-rh format will always automatically set the full membership flag 0x8000 for the PKEY_ID variable. To express IDs without the full membership flag, use PKEY_ID_NM. Note that the kernel internally treats the interface as having the full membership flag set — this mainly affects the interface name. Also: for the ifcfg file to be supported by initscripts' ifup-ib, the DEVICE= must always be set. NetworkManager does not require that. 😭

Example:

PKEY=yes PKEY_ID=2 PHYSDEV=mlx4_ib0 DEVICE=mlx4_ib0.8002
  • parent — the ifcfg-rh variable is PHYSDEV (used with PKEY=yes), and the default is PKEY=no. This is the InfiniBand parent device 👑

Example:

PHYSDEV=ib0

🍓 ipv4 setting 🍓

okay bestie, this is the big one — literally the whole IPv4 config table. every row is a property, plus the ifcfg-rh variable it maps to, its default, and what it does. read it like a menu, not a race 💅

  • method — the vibe-setter for how this interface gets its IPv4.
    • ifcfg-rh variable: BOOTPROTO
    • default: none
    • what it is: the method used for IPv4 protocol configuration.
    • allowed values: none, dhcp (bootp), static, ibft, autoip, shared
  • dns — the list of DNS servers. no cap.
    • ifcfg-rh variable: DNS1, DNS2, …
    • default: (none listed)
    • yes, even though NetworkManager supports many DNS servers, initscripts and resolver only care about the first three, usually. so don't get cute with server numero quatro 🙈
    • example:
DNS1=1.2.3.4
DNS2=10.0.0.254
DNS3=8.8.8.8
  • dns-search — the list of DNS search domains.
    • ifcfg-rh variable: DOMAIN
    • default: (none listed)
  • addresses — the list of static IP addresses, iconic behavior only ✨
    • ifcfg-rh variables: IPADDR, PREFIX (NETMASK), IPADDR1, PREFIX1 (NETMASK1), …
    • default: (none listed)
    • example:
IPADDR=10.5.5.23
PREFIX=24
IPADDR1=1.1.1.2
PREFIX1=16
  • gateway — the gateway IP address, your one-way out 🚪
    • ifcfg-rh variable: GATEWAY
    • default: (none listed)
    • example:
GATEWAY=10.5.5.1
  • routes — the list of static routes.
    • ifcfg-rh variables: ADDRESS1, NETMASK1, GATEWAY1, METRIC1, OPTIONS1, …
    • default: (none listed)
    • heads up bestie: these are not stored in the ifcfg-* file, they live in the route-* file instead. different house, same family 🏠
  • ignore-auto-routes — whether to ignore routes that come from DHCP.
    • ifcfg-rh variable: PEERROUTES(+)
    • default: yes
    • plot twist: PEERROUTES has the opposite meaning as the ignore-auto-routes property. yes, really. flip your brain accordingly 🧠
  • ignore-auto-dns — whether to ignore DNS info that comes from DHCP.
    • ifcfg-rh variable: PEERDNS
    • default: yes
    • same little trick: PEERDNS has the opposite meaning as the ignore-auto-dns property. rude but consistent 🎀
  • dhcp-send-hostname — whether DHCP_HOSTNAME should…

…be sent to the DHCP server.

  • dhcp-hostname → DHCP_HOSTNAME — no default 💜 — this is the Hostname to send to the DHCP server. And heads up, bestie: when both DHCP_HOSTNAME and DHCP_FQDN are specified, only the latter is used. The FQDN is the main character here, periodt.
  • never-default → DEFROUTE (GATEWAYDEV in /etc/sysconfig/network) — default yes ✨ — setting DEFROUTE=no tells NetworkManager that this connection should not be assigned the default route. Careful though: DEFROUTE has the opposite meaning as the 'never-default' property, so don't mix up your vibes 🫶
  • may-fail → IPV4_FAILURE_FATAL(+) — default no 🎀 — IPV4_FAILURE_FATAL has the opposite meaning as the 'may-fail' property. Yes, the naming is giving chaos, ngl. Flip the logic in your head and you're golden 💅
  • route-metric → IPV4_ROUTE_METRIC(+) — default -1 🌸 — IPV4_ROUTE_METRIC is the default IPv4 metric for routes on this connection. If it's set to -1, a default metric based on the device type is used. So -1 is basically "you pick for me, I trust you" 😌
  • route-table → IPV4_ROUTE_TABLE(+) — default 0 ⭐ — IPV4_ROUTE_TABLE enables policy-routing and sets the default routing table. fancy, love that for us 👑
  • dns-options → RES_OPTIONS(+) — no default 🦋 — this is the list of DNS options to be added to /etc/resolv.conf. Example, and keep it exact bestie:
RES_OPTIONS=ndots:2 timeout:3
  • dns-priority → IPV4_DNS_PRIORITY(+) — default 0 💀 — the priority for DNS servers of this connection. Lower values have higher priority (yes, lower = more important, it's giving backwards but that's the lore). If zero, the default value will be used: 50 for VPNs, 100 for other connections. A negative value prevents DNS from other connections with greater values to be used 🔥 — that's the "I'm the only DNS server at this function" move. Example:
IPV4_DNS_PRIORITY=20
  • auto-route-ext-gw → IPV4_AUTO_ROUTE_EXT_GW(+) — default yes 🌈 — VPN connections will default to add the route automatically unless this setting is set to FALSE. For
continued from above ⬆️ — for other connection types, adding such an automatic route is currently not supported, and setting this to TRUE has no effect. (iykyk 💅)
  • replace-local-rule — key: IPV4_REPLACE_LOCAL_RULE(+), default: no. So basically connections will default to keeping the autogenerated priority 0 local rule — unless you set this bad boy to TRUE. Simple as that, bestie ✨
  • dhcp-client-id — key: DHCP_CLIENT_ID(+). A string that gets sent to the DHCP server so it can identify the local machine. You can also hand it a binary value by using hex notation ('aa:bb:cc'). 🎀

Example:

DHCP_CLIENT_ID=ax-srv-1;
DHCP_CLIENT_ID=01:44:44:44:44:44:44
  • dad-timeout — keys: ACD_TIMEOUT(+), ARPING_WAIT. Default: a missing variable means global default (config override or zero). This is the timeout for address conflict detection before IPv4 addresses get configured — measured in milliseconds for ACD_TIMEOUT or in seconds for ARPING_WAIT. Setting 0 turns off the ACD completely, and -1 means default value. 🦋

Example:

ACD_TIMEOUT=2000

or

ARPING_WAIT=2
  • dhcp-timeout — key: IPV4_DHCP_TIMEOUT(+). A timeout after which the DHCP transaction just fails in case of no response. 😭

Example:

IPV4_DHCP_TIMEOUT=10
  • dhcp-hostname-flags — key: DHCP_HOSTNAME_FLAGS. Flags for the DHCP hostname and FQDN properties. 🚩

Example:

DHCP_HOSTNAME_FLAGS=5
  • dhcp-fqdn — key: DHCP_FQDN. The FQDN to send to the DHCP server. Heads up though — when both DHCP_HOSTNAME and DHCP_FQDN are specified, only the latter is used. Not both, bestie, only the last one 👀

Example:

DHCP_FQDN=foo.bar.com
  • dhcp-vendor-class-identifier — key: DHCP_VENDOR_CLASS_IDENTIFIER(+). The Vendor Class Identifier DHCP option (60). 🏷️

Example:

DHCP_VENDOR_CLASS_IDENTIFIER=foo
  • link-local — key: IPV4_LINK_LOCAL(+). Configure a link-local IP address in interaction with method. 🌈

Example:

IPV4_LINK_LOCAL=auto

Table 17. ipv6 setting 🌈

Ok bestie, this is the IPv6 table and it's lowkey a whole vibe — every row is a property on the left, the ifcfg-rh variable it eats on the right, and the default if you don't say anything 💅

  • method — the way IPv6 gets configured, and it's giving "many variables, one decision" energy ✨
    • ifcfg-rh variables: IPV6INIT, IPV6FORWARDING, IPV6_AUTOCONF, DHCPV6C, IPV6_DISABLED
    • defaults: IPV6INIT=yes; IPV6FORWARDING=no; IPV6_AUTOCONF=!IPV6FORWARDING, DHCPV6=no
    • the mapping is literally this and you cannot improvise it:
      • ignore ~ IPV6INIT=no
      • auto ~ IPV6_AUTOCONF=yes
      • dhcp ~ IPV6_AUTOCONF=no and DHCPV6C=yes
      • disabled ~ IPV6_DISABLED=yes
  • dns — your list of DNS servers 🎀
    • ifcfg-rh variables: DNS1, DNS2, ...
    • no default listed, so if you don't set it, that's on you bestie
    • heads up: NetworkManager uses these variables both for IPv4 and IPv6 — shared custody, no cap
  • dns-search — your list of DNS search domains 🦋
    • ifcfg-rh variable: IPV6_DOMAIN(+)
  • addresses — the list of static IP addresses, the main character energy of this table 👑
    • ifcfg-rh variables: IPV6ADDR, IPV6ADDR_SECONDARIES
    • example, copy it exactly bestie:
IPV6ADDR=ab12:9876::1
IPV6ADDR_SECONDARIES="ab12:9876::2 ab12:9876::3"
  • gateway — the gateway IP address, the door everyone walks through 🚪
    • ifcfg-rh variable: IPV6_DEFAULTGW
    • example: IPV6_DEFAULTGW=abbe::1
  • routes — your list of static routes
    • ifcfg-rh variable: (none) — yeah, it's giving "not stored here" 😭
    • these are not stored in ifcfg-* files… they live in route6-* files instead, written in the form of a command line for ip route add
  • ignore-auto-routes — default yes
    • ifcfg-rh variable: IPV6_PEERROUTES(+)
    • careful: IPV6_PEERROUTES has the opposite meaning as the ignore-auto-routes property 🔥 (flip it in your head, fr fr)
  • ignore-auto-dns — default yes
    • ifcfg-rh variable: IPV6_PEERDNS(+)
    • same situation: IPV6_PEERDNS has the opposite meaning as the ignore-auto-dns property 🙈
  • dhcp-hostname — the hostname to send the DHCP server 💌
    • ifcfg-rh variable: DHCPV6_HOSTNAME
  • dhcp-timeout — a timeout after which the DHCP transaction fails in case of no response ⏰
    • ifcfg-rh variable: IPV6_DHCP_TIMEOUT(+)
    • example: IPV6_DHCP_TIMEOUT=10
🫶 Btw those little (+) marks next to some variable names are part of the original table — keep an eye out for what they mean elsewhere in the page, iykyk.
  • dhcp-hostname-flags 🎀 — maps to DHCPV6_HOSTNAME_FLAGS, no default set, and it's literally just the flags for the DHCP hostname property, iykyk. Example: DHCPV6_HOSTNAME_FLAGS=5
  • never-default 💅 — maps to IPV6_DEFROUTE(+), plus IPV6_DEFAULTGW and IPV6_DEFAULTDEV in /etc/sysconfig/network. Default is IPV6_DEFROUTE=yes when no variable is specified. Setting IPV6_DEFROUTE=no tells NetworkManager that this connection should not be assigned the default IPv6 route. Heads up bestie: IPV6_DEFROUTE has the opposite meaning as the never-default property, so don't get it twisted 🫶
  • may-fail ✨ — maps to IPV6_FAILURE_FATAL(+), default no. IPV6_FAILURE_FATAL has the opposite meaning as the may-fail property. That's the whole vibe check.
  • route-metric 🌸 — maps to IPV6_ROUTE_METRIC(+), default -1. IPV6_ROUTE_METRIC is the default IPv6 metric for routes on this connection. If it's set to -1, a default metric based on the device type gets used instead. Slay, sensible defaults 💖
  • route-table 🦋 — maps to IPV6_ROUTE_TABLE(+), default 0. IPV6_ROUTE_TABLE enables policy-routing and sets the default routing table. Main character property fr.
  • dns-priority 👑 — maps to IPV6_DNS_PRIORITY(+), default 0. This is the priority for DNS servers of this connection. Lower values have higher priority (yes, it's giving backwards, that's just how it is 🙈). If zero, the default value will be used — 50 for VPNs, 100 for other connections. A negative value prevents DNS from other connections with greater values to be used. Ngl that's kind of powerful. Example: IPV6_DNS_PRIORITY=20
  • dns-options 🍓 — maps to IPV6_RES_OPTIONS(+), no default. It's the list of DNS options to be added to /etc/resolv.conf. Example: IPV6_RES_OPTIONS=ndots:2 timeout:3
  • auto-route-ext-gw 🔥 — maps to IPV6_AUTO_ROUTE_EXT_GW(+), default yes. VPN connections will default to add the route automatically unless this setting is set to FALSE. For other connection types, adding such an automatic route is currently not supported, and setting this to TRUE has no effect. Yeah. That's the whole story 😭
  • replace-local-rule 🧚 — maps to IPV6_REPLACE_LOCAL_RULE(+), default no. Connections will default to keep the autogenerated priority 0 local rule unless this setting is set to TRUE. Iconic behavior tbh.
  • ip6-privacy 💜 — maps to IPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP(+), default no. This configures IPv6 Privacy Extensions for SLAAC (RFC4941). Obsessed with a privacy moment 🎀 Example: IPV6_PRIVACY=rfc3041
  • IPV6_PRIVACY_PREFER_PUBLIC_IP=yes — that's the tail of the last one, bestie 💅 Allowed values: IPV6_PRIVACY: no, yes (rfc3041 or rfc4941); IPV6_PRIVACY_PREFER_PUBLIC_IP: yes, no.
  • addr-gen-mode / IPV6_ADDR_GEN_MODE — default is "default-or-eui64". This one configures IPv6 Stable Privacy addressing for SLAAC (RFC7217) ✨

Example:

IPV6_ADDR_GEN_MODE=stable-privacy

Allowed values for IPV6_ADDR_GEN_MODE: default, default-or-eui64, eui64, stable-privacy.

  • token / IPV6_TOKEN — no default here, it's the IPv6 tokenized interface identifier token 🎀

Example: IPV6_TOKEN=::53

  • ra-timeout / IPV6_RA_TIMEOUT(+) — no default, and it's literally just a timeout for waiting Router Advertisements, measured in seconds ⏳

Example: IPV6_RA_TIMEOUT=10

  • dhcp-duid / DHCPV6_DUID(+) — no default. A string sent to the DHCPv6 server to identify the local machine 🫶 Apart from the special values "lease", "stable-llt", "stable-ll", "stable-uuid", "llt" and "ll" a binary value in hex format is expected. An hex string where each octet is separated by a colon is also accepted.

Example:

DHCPV6_DUID=LL;
DHCPV6_DUID=0301deadbeef0001;
DHCPV6_DUID=03:01:de:ad:be:ef:00:01
  • dhcp-pd-hint / DHCPV6_PD_HINT(+) — no default. It's a hint for DHCPv6 prefix delegation 🌈

Example:

DHCPV6_PD_HINT=2001:db8:1111:2220::/60
DHCPV6_PD_HINT=::/60

🌸 Table 18. ipvlan setting 🌸

Okay so this table is literally empty — no properties listed, nothing to see here, and that's on periodt 💀

🦋 Table 19. match setting 🦋

  • path / MATCH_PATH — no default. It's a space-separated list of paths to match against the udev property ID_PATHS of devices 🔍

Example:

MATCH_PATH="pci-0000:01:00.0 pci-0000:0c:00.0"

🎀 Table 20. ovs-external-ids setting 🎀

Also empty, bestie. Nothing listed, no cap 🙈

⭐ Table 21. ovs-other-config setting ⭐

Empty too. The vibes are immaculate and the rows are nonexistent 💅

💜 Table 22. prefix-delegation setting 💜

And this one's empty as well — iconic behavior honestly 👑

Table 23. proxy setting 🧚‍♀️

Okay bestie, this one is the proxy table, and it's giving "small but mighty". Four properties, each one with its ifcfg-rh variable, its default, and what it actually does. The little (+) next to a variable name is literally in the original, so I'm keeping it exactly as-is — no edits, no cap 💅

  • method → ifcfg-rh variable PROXY_METHOD(+), default none — this is the method for proxy configuration. When it's set to "auto", WPAD gets used for proxy configuration, or you set the PAC file via PAC_URL or PAC_SCRIPT. Allowed values are: none, auto.
  • browser-only → ifcfg-rh variable BROWSER_ONLY(+), default no — tells you whether the proxy configuration is for browser only. Yes/no vibes, nothing more.
  • pac-url → ifcfg-rh variable PAC_URL(+), no default listed — the URL for the PAC file. Example time:
PAC_URL=http://wpad.mycompany.com/wpad.dat
  • pac-script → ifcfg-rh variable PAC_SCRIPT(+), no default listed — the PAC script itself. Heads up: this is an UTF-8 encoded javascript code that defines a FindProxyForURL() function. Example:
PAC_SCRIPT="function FindProxyForURL (url, host) { return 'PROXY proxy.example.com:8080; DIRECT'; }"

Table 24. sriov setting 🔥

SR-IOV time, aka "let's make virtual functions happen". Three properties, and the middle one is a whole family of variables hiding behind a ... — stay with me 🫶

  • total-vfs → ifcfg-rh variable SRIOV_TOTAL_VFS(+), no default listed — the total number of virtual functions to create. Example:
SRIOV_TOTAL_VFS=16
  • vfs → ifcfg-rh variables SRIOV_VF1(+), SRIOV_VF2(+), ... — SR-IOV virtual function descriptors. Note that it's numbered per-VF, so you get a whole lineup of them. Example:
SRIOV_VF10="mac=00:11:22:33:44:55", ...
  • autoprobe-drivers → ifcfg-rh variable SRIOV_AUTOPROBE_DRIVERS(+), default: missing variable means global default — this one decides whether to autoprobe virtual functions by a compatible driver. And yes, the default really is described as "missing variable means global default", so don't come for me, I'm just the messenger 🌸 Example:
SRIOV_AUTOPROBE_DRIVERS=0,1

Table 25. tc setting 💅

Okay bestie, this is the traffic-control corner of the ifcfg world, and there are two props here. Both are giving "no default, you decide" energy — the Default column is literally empty for both, so don't come for me, that's just how it is. 🫶

  • qdiscs — ifcfg-rh variables: QDISC1(+), QDISC2(+), ..., TC_COMMIT(+). No default. These are the queueing disciplines to set on the interface. Here's the important bit, so like, pay attention: when no QDISC1, QDISC2, ..., FILTER1, FILTER2, ... keys are present, NetworkManager doesn't touch qdiscs and filters present on the interface — unless TC_COMMIT is set to 'yes'. Yes, that's the same caveat as the next one, because they're a package deal. 🎀

Example, straight up:

QDISC1=ingress, QDISC2="root handle 1234: fq_codel"
  • tfilters — ifcfg-rh variables: FILTER1(+), FILTER2(+), ..., TC_COMMIT(+). No default. These are the traffic filters to set on the interface. And same rule as above, fr fr: when no QDISC1, QDISC2, ..., FILTER1, FILTER2, ... keys are present, NetworkManager doesn't touch qdiscs and filters present on the interface, unless TC_COMMIT is set to 'yes'. 👑

Example:

FILTER1="parent ffff: matchall action simple sdata Input", ...
Reminder bestie: those two descriptions are genuinely the same condition word-for-word — it's not me being lazy, that's what the page says. The dot-dot-dot in the filter example is also literally in the original, so don't @ me. 💀

Table 26. team setting 🦋

One (1) property. Very demure, very mindful.

  • config — ifcfg-rh variable: TEAM_CONFIG. No default. This is the team configuration in JSON. See man teamd.conf for details. That's it, that's the whole row. ✨

Table 27. team-port setting 🌸

The sequel to team setting, and yes it's also just one property. Consistency slay.

  • config — ifcfg-rh variable: TEAM_PORT_CONFIG. No default. This is the team port configuration in JSON. See man teamd.conf for details. (Same manpage reference as the team one, because of course it is. iykyk.) 🧚

Table 28. user setting 👑

One property, but the description is a whole journey. Buckle up.

  • data — ifcfg-rh variable: NM_USER_*. No default. Each key/value pair is stored as a separate variable, with the name composed by concatenating NM_USER_ with the encoded key. Sounds fake? It's real. Here's how the encoding goes, step by step:
    • lowercase letters get substituted with uppercase. 🔠
    • uppercase letters get an underscore prepended to them.
    • a dot is encoded as a double underscore.
    • the remaining characters are encoded as an underscore followed by a 3 digit octal representation of the character.

And the example, in all its glory:

NM_USER_FOO__BAR=something
That's the whole encoding lore, bestie. No extra rules, no secret sixth step — I'm not inventing anything, I promise on my life. 💖

🦋 Table 29. vlan setting 🦋

Okay bestie, this is the VLAN table and it's lowkey a lot of rows, so buckle up 🎀 Each row is a property, the ifcfg-rh variable (or variables!) it maps to, its default, and what it actually does. And ngl, every single default here is just empty — like, nothing's filled in unless you fill it in 💅

  • parent — ifcfg-rh variable: DEVICE or PHYSDEV. Default: empty. This is the parent interface of the VLAN — the one the VLAN is riding on top of ✨
  • id — ifcfg-rh variable: VLAN_ID, DEVICE.. Default: empty. This is the VLAN identifier. If VLAN_ID is not set, it is attempted to be detected from the suffix of DEVICE=. 🫶 But heads up: older versions of NetworkManager had a bug where they would prefer the detected ID from the DEVICE over VLAN_ID. So if you're on an old version, that's the drama 💀
  • flags — ifcfg-rh variables: GVRP, MVRP, VLAN_FLAGS. Default: empty. These are the VLAN flags. Allowed values: "yes or "no" for GVRP and MVRP; "LOOSE_BINDING" and "NO_REORDER_HDR" for VLAN_FLAGS ⭐
  • protocol — ifcfg-rh variable: VLAN_PROTOCOL. Default: empty. The VLAN protocol. Example, iconically:
VLAN_PROTOCOL="802.1ad"
  • ingress-priority-map — ifcfg-rh variable: VLAN_INGRESS_PRIORITY_MAP. Default: empty. Ingress priority mapping. Example:
VLAN_INGRESS_PRIORITY_MAP=4:2,3:5
  • egress-priority-map — ifcfg-rh variable: VLAN_EGRESS_PRIORITY_MAP. Default: empty. Egress priority mapping. Example:
VLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7
  • interface-name — ifcfg-rh variable: PHYSDEV and VLAN_ID, or DEVICE. Default: empty. The VLAN interface name. Now listen closely because this is the messy part 🙈 If all variables are set, the parent device from PHYSDEV takes precedence over DEVICE, but the VLAN id from DEVICE takes precedence over VLAN_ID. Example:
PHYSDEV=eth0, VLAN_ID=12

or

DEVICE=eth0.12

And the tea on what this plugin simply will not do: the following settings are not supported by the ifcfg-rh plugin, periodt 🚫

6lowpan, 802-11-olpc-mesh, adsl, bluetooth, cdma, dummy, generic, gsm, ip-tunnel, link, loopback, macsec, macvlan, ovs-bridge, ovs-dpdk, ovs-interface, ovs-patch, ovs-port, ppp, pppoe, serial, tun, veth, vpn, vrf, vxlan, wifi-p2p, wimax, wireguard, wpan

Like, if your fave connection type is in that list, this is not the plugin for you and that's just how it is 💅

🌸 Secret flags 🌸

So every secret property in a NetworkManager setting has an associated flags property, and that's what tells everyone how to handle that secret. In the ifcfg-rh plugin, the variables for secret flags have a _FLAGS suffix — cute, consistent, we love her ✨

The variables contain one or more of the following values, space separated. And if a *_FLAGS variable is missing (or empty), that means the password is owned by NetworkManager 🫶

  • user — a user-session secret agent is responsible for providing and storing this secret; when it is required, agents will be asked to provide it.
  • ask — the associated password is not saved but it will be requested from the user each time it is required. 😭 every single time, bestie
  • unused — in some situations it cannot be automatically determined that a secret is required or not. This flag hints that the secret is not required and should not be requested from the user.

📁 FILES 📁

  • /etc/sysconfig/network-scripts/ifcfg-*
  • /etc/sysconfig/network-scripts/keys-*
  • /etc/sysconfig/network-scripts/route-*
  • /etc/sysconfig/network-scripts/route6-*
  • /usr/share/doc/initscripts/sysconfig.txt

👀 SEE ALSO 👀

And that's the whole page, bestie — you made it to the end, I'm so proud of you fr fr 🥹💖 This was NetworkManager 1.54.4, page NM-SETTINGS-IFCFG-RH(5), and it's giving iconic reference material from start to finish. Now go configure something and slay 🌈👑

📦 where this page comes from