Setting a static IPv4 address with nmcli without locking yourself out

Goal

Give a network interface a static IPv4 address, gateway and DNS servers through NetworkManager, using a method that does not cut off an SSH session on the interface being changed.

Prerequisites

• NetworkManager active (nmcli general status); a connection profile already bound to the target device.
• Root or a polkit rule allowing connection changes.
• A second access path (console, out-of-band management, or a second NIC) is the only fully safe fallback. Without one, a cloned profile plus a scheduled automatic rollback (step 4) is the next-best option; cloning alone does not help once the session is gone.

Steps

1. Inspect current state: nmcli -t -f NAME,DEVICE,TYPE connection show and nmcli device show eth0.
2. Clone the live profile instead of editing it in place: nmcli connection clone "eth0-dhcp" "eth0-static". This keeps the working profile untouched.
3. Configure the clone (does not affect the active connection yet):

   nmcli connection modify eth0-static ipv4.addresses 203.0.113.10/24
   nmcli connection modify eth0-static ipv4.gateway 203.0.113.1
   nmcli connection modify eth0-static ipv4.dns "203.0.113.53 203.0.113.54"
   nmcli connection modify eth0-static ipv4.method manual
   nmcli connection modify eth0-static connection.autoconnect yes
   

4. Schedule a rollback first, then activate: systemd-run --on-active=5min nmcli connection up eth0-dhcp (root), followed by nmcli -w 30 connection up eth0-static. If the new address is wrong and the session drops, the timer restores the old profile after five minutes; activation runs inside NetworkManager, so a dropped SSH session does not abort it. Do not rely on a reboot to restore the old profile: with two autoconnect profiles for the same device, NetworkManager prefers the higher connection.autoconnect-priority and then the most recently used one — the new profile.
5. Once reachability is confirmed from a new session to the new address, cancel the rollback (systemctl list-timers 'run-*', then systemctl stop <unit>.timer) and disable or delete the old profile: nmcli connection modify eth0-dhcp connection.autoconnect no (keep it for rollback) or nmcli connection delete eth0-dhcp.

Expected result

nmcli -t -f IP4.ADDRESS,IP4.GATEWAY,IP4.DNS device show eth0 shows the new values. New profiles are stored as keyfiles under /etc/NetworkManager/system-connections/ on Debian, Fedora 33+ and RHEL 9+; RHEL 8 writes ifcfg files under /etc/sysconfig/network-scripts/, and Ubuntu 23.10+ stores NetworkManager profiles as netplan YAML (/etc/netplan/90-NM-*.yaml).

Limits and test basis

Commands verified against the nmcli(1) manual page (network-manager package). nmcli connection up blocks until the connection reaches the activated state or times out (-w seconds controls the timeout, default 90 seconds); a non-interactive script should always pass -w explicitly rather than rely on the default.