What you will achieve

Connect to WPA2/WPA3 Wi‑Fi from a terminal when no GUI is available — headless Pi, server laptop, or rescue shell with NetworkManager or wpa_supplicant.

1) Check hardware and drivers

ip link
nmcli device status
sudo dmesg | grep -i firmware

Missing firmware is common — install firmware-linux (Debian) or linux-firmware (Fedora).

2) NetworkManager (Ubuntu/Debian desktop and server with NM)

nmcli device wifi list
nmcli device wifi connect "SSID" password "passphrase"
nmcli connection show

3) wpa_supplicant without NetworkManager

wpa_passphrase "SSID" "passphrase" | sudo tee /etc/wpa_supplicant/wpa_supplicant.conf
sudo wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf
sudo dhclient wlan0

4) netplan (Ubuntu server)

If netplan manages Wi‑Fi, define renderer NetworkManager or wpa_supplicant in /etc/netplan/*.yaml, then sudo netplan apply.

Verify

ping -c3 1.1.1.1
resolvectl status

5) Hidden SSIDs

nmcli device wifi connect "HiddenSSID" password "secret" hidden yes

6) 802.1X enterprise

nmcli connection add type wifi con-name "Corp" ssid "CorpWiFi"   wifi.security 802-1x 802-1x.eap tls   802-1x.identity "user@corp.com"   802-1x.ca-cert /path/to/ca.pem   802-1x.client-cert /path/to/client.pem   802-1x.private-key /path/to/key.pem

7) Raspberry Pi / Debian without NM

Edit /etc/wpa_supplicant/wpa_supplicant.conf and enable via systemctl enable wpa_supplicant@wlan0 on systemd networks.

Troubleshooting

RTNETLINK answers: Operation not possible due to RF-kill — rfkill list, unblock Wi‑Fi.
Wrong regulatory domain — sudo iw reg set GB (adjust country).
Driver loaded but no scan — check dmesg for firmware request failures.

8) Regulatory and channel width

iw dev wlan0 scan | grep -E 'SSID|signal|freq'

Confirm you associate to expected BSSID on mesh networks with duplicate SSIDs.

Prerequisites

Wireless interface visible in ip link (wlan0, wlp2s0). Correct firmware package installed. SSID and WPA passphrase. For enterprise: CA cert, client cert, identity.

NetworkManager vs systemd-networkd

Ubuntu Desktop uses NetworkManager. Ubuntu Server may use netplan + systemd-networkd without NM — install network-manager if you want nmcli on server images.

Regulatory domain persist

echo 'REGDOMAIN=GB' | sudo tee /etc/default/crda

Wrong domain limits channels — legal requirement on 5 GHz APs.

iwctl on systemd-networkd/iwd systems

Fedora and some Arch setups use iwd instead of wpa_supplicant directly — iwctl interactive shell: device list, station wlan0 connect SSID. Mixing iwd and NetworkManager causes fights; pick one stack. On Raspberry Pi OS, raspi-config sets country code required before 5 GHz channels unlock legally.

USB Wi‑Fi adapter quirks

Realtek USB adapters need driver compile on some kernels — check lsusb and distro wiki before assuming firmware-linux-nonfree fixes it. Persistent interface naming: udev rule for MAC to name wlan1 consistently when multiple adapters present for lab testing.