So using nm-applet its quite easy to save vpn connection and username+password of the connection and then automatically connect to it when using certain wi-fi connection. So it will always automatically connect to it without asking passwords.

How to achieve this by terminal using nmcli etc? Trying to script it to make it easier to deploy more connections and edit them.

So far I only managed to

nmcli connection import type openvpn file ned.ovpn

Also I noticed that once saved connections can be found at


I tried to copy same settings from laptop to desktop but nothing seemed to change. It didnt seem to see/change those settings.

  • Method: use nmcli to dump settings. Use nm-applet to change the settings (to automatically connect to vpn). Use again nmcli to dump settings. Compare before and after to know what setting changed. You now know a new setting usable with nmcli. – A.B May 2 at 21:43
  • How do you dump nmcli settings? – speedstern00b May 4 at 7:55

Here's a detailed explanation from my initial comment. The goal is to learn what is the equivalent using the CLI tool nmcli without having to browse through all the documentation to pinpoint a setting as long as it's known by the user on the GUI tool: with the temporary help of this GUI tool nm-applet, which has to be available somewhere (not even the same system) with an equivalent setup. This is just a generic method which could be used for any other setting than the one considered here.

There are two connections involved: I'll call them main, and myVPN which is to be automatically connected when using main. Here the change will be done on main, that's the one which must be examined.

$ nmcli connection show
NAME                UUID                                  TYPE       DEVICE 
main                cfa5be23-925a-4273-b5de-2f9adaac8782  wifi       --
myVPN               0d9e60ef-6b5e-4f65-8312-8db428589866  vpn        --

To display the configuration of main, either of these (and probably more shortcut versions):

nmcli connection show connection id main
nmcli connection show connection uuid cfa5be23-925a-4273-b5de-2f9adaac8782

will dump among many other lines something like:

connection.id:                          main
connection.uuid:                        cfa5be23-925a-4273-b5de-2f9adaac8782
connection.type:                        802-11-wireless


So first dump all of it in a file. Some of the output is localized, so better do export LANG=C.UTF-8 before (if later a specific setting name or value should be searched or compared on internet this would help):

nmcli c show id main > /tmp/before

Using the GUI tool nm-applet where the feature is known, the VPN myVPN is added to main:

set VPN autoconnect

Dump it again:

nmcli c show id main > /tmp/after

Now diff can compare and show what changed:

$ diff -u /tmp/before /tmp/after
--- /tmp/before 2019-05-04 10:47:43.410149358 +0200
+++ /tmp/after  2019-05-04 10:47:58.798252044 +0200
@@ -15,7 +15,7 @@
 connection.master:                      --
 connection.slave-type:                  --
 connection.autoconnect-slaves:          -1 (default)
-connection.secondaries:                 --
+connection.secondaries:                 0d9e60ef-6b5e-4f65-8312-8db428589866
 connection.gateway-ping-timeout:        0
 connection.metered:                     unknown
 connection.lldp:                        default

So that means the previously inconspicuous setting connection.secondaries got set, without too much trouble to guess, to myVPN's UUID: 0d9e60ef-6b5e-4f65-8312-8db428589866. nm-settings(5) tells about it in connection setting:

secondaries array of string []

List of connection UUIDs that should be activated when the base connection itself is activated. Currently only VPN connections are supported.

You can now clear again any automatic connection to VPN on main with:

nmcli c modify id main connection.secondaries ''

and add again myVPN with (it's an array, hence +):

nmcli c modify id main +connection.secondaries 0d9e60ef-6b5e-4f65-8312-8db428589866

With some glue code (retrieving uuid from id etc.) this can now be automated.

Of course the corresponding line is added or removed in a file somewhere in /etc/NetworkManager/, but this should not be relied upon.

NB: I didn't know about this setting before writting this answer, I just did what I told.

  • Thanks mate. Learned a lot from the way you do things. By testing the changes to see which is the part thats important. The only thing that troubles me is that the UUID changes everytime I reinstall computer or add a new vpn connection. But then I guess I could somehow try to find out how to grep and sed – speedstern00b May 18 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.