Static IP with nmcli: Rocky 9 networking and the keyfile format

When to use it

A new host needs a fixed IP, a different gateway or extra DNS, or a network change “does not take effect”. Rocky 9 networking is managed by NetworkManager, nmcli is its CLI, and the configuration ends up in keyfiles under /etc/NetworkManager/system-connections/.

Understand connections and devices first

NetworkManager separates the device from the connection profile: the NIC is a device, the static IP/DHCP settings are a connection, and one device can hold several connections (ordered by autoconnect priority).

Profiles live in keyfiles whose permission must be 600:

-rw------- 1 root root 182 ... enp1s0.nmconnection

The content looks like this (the real file inside a rockylinux:9 container, uuid/id redacted):

[connection]
id=<id>
uuid=<uuid>
type=ethernet
interface-name=enp1s0

[ethernet]

[ipv4]
method=auto

[ipv6]
addr-gen-mode=eui64
method=auto

method=auto is DHCP; a static setup becomes method=manual with address1=..., gateway=... and dns=....

Why nmcli does not work in a container

nmcli --version
nmcli general status

nmcli tool, version 1.54.3-5.el9_8
Error: Could not create NMClient object: Could not connect: No such file or directory.

The CLI is present, but it talks to the NetworkManager daemon over D-Bus; the container has neither systemd nor the daemon. The commands below must run on a real system (marked “not tested in this environment” here).

Set a static IP (run on a real system)

nmcli connection show
nmcli connection add type ethernet ifname enp1s0 con-name static-enp1s0 \
  ipv4.method manual ipv4.addresses 192.0.2.10/24 \
  ipv4.gateway 192.0.2.1 ipv4.dns "192.0.2.53 1.1.1.1"
nmcli connection up static-enp1s0

Key points:

• ipv4.method manual makes it static; auto means DHCP;
• ipv4.addresses accepts several addresses, comma separated;
• a connection up (or nmcli device reapply) is required before it takes effect.

Verify

nmcli -p connection show static-enp1s0
ip -4 addr show enp1s0
ip route show default
cat /etc/resolv.conf
ping -c 2 192.0.2.1

Check in order: connection activated → address present in ip → default route points at the gateway → a nameserver exists → the gateway answers ping.

Common traps

• Modifying without bringing the connection up: nmcli connection modify only edits configuration;
• Breaking keyfile permissions: 600 is mandatory; with 644 NetworkManager ignores the file;
• Mixing nmcli with hand-written ifcfg files: EL9 defaults to the keyfile backend, so /etc/sysconfig/network-scripts/ifcfg-* written by hand may have no effect.

Practice: switch DHCP to static and verify

Prerequisite: a Rocky 9 VM reachable over console or SSH (changing networking can drop your session — use the console).

nmcli connection show
nmcli connection modify "<existing connection>" ipv4.method manual \
  ipv4.addresses 192.0.2.10/24 ipv4.gateway 192.0.2.1 ipv4.dns 192.0.2.53
nmcli connection up "<existing connection>"

Checks:

1. nmcli -f ipv4.method,ipv4.addresses connection show "<name>" → manual and the target address
2. ip -4 addr show → the address is active
3. ip route show default → default route is 192.0.2.1
4. cat /etc/resolv.conf → contains nameserver 192.0.2.53
5. After a reboot, nmcli connection show --active → still active

Next steps

• Opening ports: firewall-cmd rules
• Post-install checks: First-hour checks
• Offline installs: Offline package installs