[main]
plugins=keyfile

plugins+=another-plugin
plugins-=remove-me

The default value and the number of available plugins is distro-specific. See the section called “PLUGINS” below for the available plugins. Note that NetworkManager's native keyfile plugin is always appended to the end of this list (if it doesn't already appear earlier in the list).

If this key is missing, it defaults to dhclient. It the chosen plugin is not available, clients are looked for in this order: dhclient, dhcpcd, internal.

When the default wired connection is deleted or saved to a new persistent connection by a plugin, the device is added to a list in the file /run/NetworkManager/no-auto-default.state to prevent creating the default connection for that device again.

See the section called “Device List Format” for the syntax how to specify a device.

Example:

no-auto-default=00:22:68:5c:5d:c4,00:1e:65:ff:aa:ee
no-auto-default=eth0,eth1
no-auto-default=*

See the section called “Device List Format” for the syntax how to specify a device.

default: NetworkManager will update the hostname with the one provided via DHCP on the main connection (the one with a default route). If not present, the hostname will be updated to the last one set outside NetworkManager. If it is not valid, NetworkManager will try to recover the hostname from the reverse lookup of the IP address of the main connection. If this fails too, the hostname will be set to 'localhost.localdomain'.

dhcp: NetworkManager will update the transient hostname only with information coming from DHCP. No fallback nor reverse lookup will be performed, but when the dhcp connection providing the hostname is deactivated, the hostname is reset to the last hostname set outside NetworkManager or 'localhost' if none valid is there.

none: NetworkManager will not manage the transient hostname and will never set it.

default: NetworkManager will update /etc/resolv.conf to reflect the nameservers provided by currently active connections.

dnsmasq: NetworkManager will run dnsmasq as a local caching nameserver, using a "split DNS" configuration if you are connected to a VPN, and then update resolv.conf to point to the local nameserver. It is possible to pass custom options to the dnsmasq instance by adding them to files in the "/etc/NetworkManager/dnsmasq.d/" directory. Note that when multiple upstream servers are available, dnsmasq will initially contact them in parallel and then use the fastest to respond, probing again other servers after some time. This behavior can be modified passing the 'all-servers' or 'strict-order' options to dnsmasq (see the manual page for more details).

unbound: NetworkManager will talk to unbound and dnssec-triggerd, providing a "split DNS" configuration with DNSSEC support. /etc/resolv.conf will be managed by dnssec-trigger daemon.

systemd-resolved: NetworkManager will push the DNS configuration to systemd-resolved

none: NetworkManager will not modify resolv.conf. This implies rc-manager unmanaged

symlink: If /etc/resolv.conf is a regular file, NetworkManager will replace the file on update. If /etc/resolv.conf is instead a symlink, NetworkManager will leave it alone. Unless the symlink points to the internal file /run/NetworkManager/resolv.conf, in which case the symlink will be updated to emit an inotify notification. This allows the user to conveniently instruct NetworkManager not to manage /etc/resolv.conf by replacing it with a symlink.

file: NetworkManager will write /etc/resolv.conf as file. If it finds a symlink to an existing target, it will follow the symlink and update the target instead. In no case will an existing symlink be replaced by a file. Note that older versions of NetworkManager behaved differently and would replace dangling symlinks with a plain file.

resolvconf: NetworkManager will run resolvconf to update the DNS configuration.

netconfig: NetworkManager will run netconfig to update the DNS configuration.

unmanaged: don't touch /etc/resolv.conf.

none: deprecated alias for symlink.

RLIMIT_CORE: set ulimit -c unlimited to write out core dumps. Beware, that a core dump can contain sensitive information such as passwords or configuration settings.

fatal-warnings: set g_log_set_always_fatal() to core dump on warning messages from glib. This is equivalent to the --g-fatal-warnings command line option.

See the section called “Device List Format” for the syntax how to specify a device.

Example:

unmanaged-devices=interface-name:em4
unmanaged-devices=mac:00:22:68:1c:59:b1;mac:00:1E:65:30:D1:C4;interface-name:eth2

The default value is false.

In addition, these special domains can be used: NONE, ALL, DEFAULT, DHCP, IP.

You can specify per-domain log level overrides by adding a colon and a log level to any domain. E.g., "WIFI:DEBUG,WIFI_SCAN:OFF".

Domain descriptions:

In general, the logfile should not contain passwords or private data. However, you are always advised to check the file before posting it online or attaching to a bug report. VPN_PLUGIN is special as it might reveal private information of the VPN plugins with verbose levels. Therefore this domain will be excluded when setting ALL or DEFAULT to more verbose levels then INFO.

[connection]
ipv6.ip6-privacy=0

[device]
match-device=interface-name:eth3
managed=1

# always skip loading the config file
[.config]
enable=false

You can also match against the version of NetworkManager. For example the following are valid configurations:

# only load on version 1.0.6
[.config]
enable=nm-version:1.0.6
# load on all versions 1.0.x, but not 1.2.x
[.config]
enable=nm-version:1.0
# only load on versions >= 1.1.6. This does not match
# with version 1.2.0 or 1.4.4. Only the last digit is considered.
[.config]
enable=nm-version-min:1.1.6
# only load on versions >= 1.2. Contrary to the previous
# example, this also matches with 1.2.0, 1.2.10, 1.4.4, etc.
[.config]
enable=nm-version-min:1.2
# Match against the maximum allowed version. The example matches
# versions 1.2.0, 1.2.2, 1.2.4. Again, only the last version digit
# is allowed to be smaller. So this would not match match on 1.1.10.
[.config]
enable=nm-version-max:1.2.6

You can also match against the value of the environment variable NM_CONFIG_ENABLE_TAG, like:

# always skip loading the file when running NetworkManager with
# environment variable "NM_CONFIG_ENABLE_TAG=TAG1"
[.config]
enable=env:TAG1

More then one match can be specified. The configuration will be enabled if one of the predicates matches ("or"). The special prefix "except:" can be used to negate the match. Note that if one except-predicate matches, the entire configuration will be disabled. In other words, a except predicate always wins over other predicates. If the setting only consists of "except:" matches and none of the negative conditions are satisfied, the configuration is still enabled.

# enable the configuration either when the environment variable
# is present or the version is at least 1.2.0.
[.config]
enable=env:TAG2,nm-version-min:1.2
# enable the configuration for version >= 1.2.0, but disable
# it when the environment variable is set to "TAG3"
[.config]
enable=except:env:TAG3,nm-version-min:1.2
# enable the configuration on >= 1.3, >= 1.2.6, and >= 1.0.16.
# Useful if a certain feature is only present since those releases.
[.config]
enable=nm-version-min:1.3,nm-version-min:1.2.6,nm-version-min:1.0.16

The stored connection file may contain passwords, secrets and private keys in plain text, so it will be made readable only to root, and the plugin will ignore files that are readable or writable by any user or group other than root. See "Secret flag types" in nm-settings(5) for how to avoid storing passwords in plain text.

This plugin is always active, and will automatically be used to store any connections that aren't supported by any other active plugin.

This plugin is read-only; any connections (of any type) added from within NetworkManager when you are using this plugin will be saved using the keyfile plugin instead.

Note that ibft plugin uses /sbin/iscsiadm and thus requires CAP_SYS_ADMIN capability.