How to connect to WiFi through the terminal command line?

Connecting to WiFi from the terminal matters most when there is no desktop to click through. A minimal Arch install drops you at a root shell with no GUI, a headless server has no desktop at all, and a broken display manager leaves you with only a login prompt. nmcli, the command line client for NetworkManager, brings up the wireless connection and confirms it works.

NetworkManager ships by default on Ubuntu, Fedora, Linux Mint, and most desktop distributions, and it is present on the official Arch ISO. If your distribution does not use NetworkManager, jump to the wpa_supplicant section near the end.

Step 1: Find Your Wireless Interface

Before touching any settings, find the name of your wireless card. Modern distributions use predictable names like wlp2s0 instead of the older wlan0, so do not assume a name. The ip command is the quickest way to list what the kernel sees.

$ ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536
2: enp3s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
3: wlp2s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DORMANT

The wireless entry is the one whose description contains Wi-Fi or Wireless when you run ip -br link, but the surest check is nmcli itself:

$ nmcli device
DEVICE   TYPE      STATE                   CONNECTION
wlp2s0   wifi      disconnected            --
enp3s0   ethernet  unavailable             --
lo       loopback  unmanaged               --

The TYPE column tells you which device is wifi. Everything that follows assumes this interface is wlp2s0. Replace it with your own device name wherever it appears.

Step 2: Make Sure the Radio Is Not Blocked or Disabled

Two switches sit between you and any scan. The software radio switch belongs to NetworkManager, and rfkill reports both software and hardware blocks such as a physical airplane-mode key on a laptop. Check both before debugging anything else.

$ nmcli radio wifi
enabled
$ rfkill list
0: phy0: Wireless LAN
	Soft blocked: no
	Hard blocked: no

If the radio shows disabled, turn it on:

$ nmcli radio wifi on

If rfkill shows Soft blocked: yes, unblock it with rfkill unblock all. Hard blocked: yes is different. That state comes from a physical switch or BIOS setting, so look for a function key or an airplane-mode toggle rather than a command fix.

Some HP laptops ship a firmware quirk where loading the hp_wmi module hard-blocks the radio. Blacklisting the module fixes it:

$ echo "blacklist hp_wmi" | sudo tee /etc/modprobe.d/hp.conf
$ sudo reboot

Reboot after blacklisting so the module stays unloaded, then recheck rfkill.

Step 3: Scan for Available Networks

With the interface visible and the radio enabled, list every access point in range:

$ nmcli dev wifi list
IN-USE  BSSID              SSID          MODE   CHAN  RATE       SIGNAL  BARS  SECURITY
        60:63:4C:5D:F6:69  home-network  Infra  1     270 Mbit/s 100     ▂▄▆█  WPA2

The network you are already on carries an asterisk in IN-USE. Note the SSID exactly as shown because it is case sensitive.

Hidden networks never appear here because a scan cannot reveal them. Supply the name manually during the connect step.

$ nmcli dev wifi rescan

Connect with an interactive password prompt

The safest form asks for the password without echoing it into your shell history:

$ sudo nmcli --ask dev wifi connect "home-network"
Password: ••••••••••••
Device 'wlp2s0' successfully activated with 'f747251b-1346-48a2-ae25-1b6fd6243984'.

Connect in a single command

Scripts and provisioning setups prefer one line with the password inline:

$ sudo nmcli dev wifi connect "home-network" password "MyPassword123"
Device 'wlp2s0' successfully activated with 'a583ac06-30da-4e8b-b9e0-674ec33bece8'.

Connect to a hidden network

A hidden SSID never appears in the scan output. Create its profile first, then activate it:

$ sudo nmcli con add type wifi ifname wlp2s0 con-name "hidden-net" ssid "hidden-net"
$ sudo nmcli con modify hidden-net wifi-sec.key-mgmt wpa-psk
$ sudo nmcli con modify hidden-net 802-11-wireless-security.psk "MyPassword123"
$ nmcli con up hidden-net

nmcli saves every successful connection as a profile under /etc/NetworkManager/system-connections/. On reboot, NetworkManager reconnects to the last network automatically. To stop that for one profile:

$ nmcli con modify "home-network" connection.autoconnect no

Step 4: Verify the Connection

Activation messages can lie about internet access, so prove the route works end to end. First check that your device pulled an address, then ping a public IP so DNS problems cannot hide behind a working link.

$ nmcli dev show wlp2s0 | grep IP4
IP4.ADDRESS[1]:                           192.168.1.42/24
IP4.GATEWAY:                              192.168.1.1
IP4.DNS[1]:                               192.168.1.1
$ ping -c 4 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=114 time=50.4 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=114 time=46.4 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=114 time=45.2 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=114 time=44.9 ms

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 44.908/46.725/50.412/2.153 ms

Four replies with 0% packet loss means the link and routing work. If pinging 8.8.8.8 succeeds while pinging google.com fails, your address is fine but DNS is not, and the next section covers the usual suspects.

Troubleshooting Failed Connections

Most failures fall into three groups. The password is wrong, the system cannot see a wireless device at all, or the link works but the internet does not. Match your symptom to the fix below.

Password rejected or activation failed

A 4-way handshake failure means the password is wrong for that SSID. Re-run the connect with –ask and type the password again. If activation times out instead, your signal may be too weak or the AP may filter MAC addresses.

$ nmcli -f GENERAL.STATE dev show wlp2s0
GENERAL.STATE:                          30 (disconnected)

State 30 means no profile is active. Check the NetworkManager log for the exact failure:

$ sudo journalctl -u NetworkManager --since "5 minutes ago" | grep -iE 'auth|fail|reason'

No Wi-Fi device found

This nmcli error usually means one of three things. The wireless driver failed to load, rfkill holds the card blocked, or you are in a minimal environment where NetworkManager is not running at all. Check them in that order:

$ lspci | grep -i network
$ lsusb | grep -i wireless
$ rfkill list
$ systemctl status NetworkManager

If NetworkManager is inactive on a minimal system, start it and try again:

$ sudo systemctl start NetworkManager

If no wireless card appears in lspci or lsusb at all, the driver or firmware is missing rather than blocked. Most distributions ship a linux-firmware package that covers common cards:

$ sudo apt install linux-firmware      # Debian, Ubuntu, Mint
$ sudo dnf install linux-firmware      # Fedora

Connected but no internet

A working link without internet is almost always DNS. Confirm which nameserver your profile inherited, then test resolution directly:

$ resolvectl status wlp2s0 | grep "DNS Servers"
$ nslookup google.com

If nslookup fails while ping to 8.8.8.8 works, set a public resolver on the connection profile:

$ sudo nmcli con modify "home-network" ipv4.dns "8.8.8.8 8.8.4.4"
$ sudo nmcli con modify "home-network" ipv4.ignore-auto-dns yes
$ nmcli con up "home-network"

Rerunning con up applies the new DNS settings without touching the rest of the profile.

Manage Saved Connections

Every network you connect to becomes a saved profile, which is why reconnecting later needs no password. A few commands cover most day-to-day management:

Deleting a profile also deletes its stored password, so the next connection asks for it again. Once you are online, ss and netstat show which services are listening on your new connection.

Connect Without NetworkManager Using wpa_supplicant

Minimal systems such as a vanilla Arch installation or a tiny server image often have no NetworkManager at all. The fallback is wpa_supplicant plus dhcpcd, both of which are present on the official Arch ISO.

# wpa_passphrase "home-network" "MyPassword123" > /etc/wpa_supplicant/wpa_supplicant-wlp2s0.conf
# wpa_supplicant -B -i wlp2s0 -c /etc/wpa_supplicant/wpa_supplicant-wlp2s0.conf
# dhcpcd wlp2s0

wpa_passphrase writes the config file with the encrypted pre-shared key, so the plaintext password never sits on disk. dhcpcd then negotiates an address from the router.

Verify with ip addr show wlp2s0 and the same ping test as before. If you are more familiar with the ifconfig command, ip addr replaces it on current distributions. One boundary matters here: iw can only associate with open networks on its own, so WPA networks always need a supplicant handling the key exchange.

FAQs

Conclusion

Four steps take you from a dead interface to a working route: find the device name, clear any rfkill or radio block, scan and connect by SSID, then prove the result with a ping to a public address. Saved profiles make every future boot automatic. When NetworkManager is absent, wpa_supplicant covers the same ground with three commands.