Module 9 · Network & VPN: Wi-Fi, Ethernet, OpenVPN, WireGuard, Cisco
"Can I get online at work, from the hotel, through the corporate VPN?" Yes, all of it. Linux ships with a single service called NetworkManager that handles every kind of network connection: Wi-Fi, Ethernet, captive portals, OpenVPN, WireGuard, Cisco AnyConnect (via OpenConnect), corporate proxies. You almost always do everything from one place: the top-right system status menu and Settings → Network. This module walks through each scenario.
By the end of this module, you will:
- Connect to Wi-Fi from the top-right menu, pick the network, type the password once, Linux remembers it forever
- Plug in Ethernet and be online in 2-3 seconds (no driver, no install)
- Sail through captive portals at hotels, cafes and airports without thinking about them
- Set up a corporate OpenVPN or WireGuard VPN from a
.ovpn/.conffile in two clicks (Settings → Network → VPN → Import from file) - Connect to a Cisco AnyConnect corporate VPN via OpenConnect, install the OpenConnect plugin from your distro's app store (or ask IT to push it on a managed laptop), then add the VPN in Settings → Network
- Set up a certificate-based VPN from a
.p12file your IT team sent you - Diagnose flaky Wi-Fi, no internet, VPN-no-traffic, DNS failures and slow sites from Settings → Network, and know when to escalate to IT
It's all one menu
On Windows, Wi-Fi, Ethernet, VPN and proxy settings live in four different places. On Linux they live in one: the system status menu (top-bar on GNOME, system tray on KDE Plasma / XFCE) plus Settings → Network on GNOME (or System Settings → Connections on KDE Plasma). Behind both is a service called NetworkManager, it remembers your Wi-Fi passwords, watches your network cables, runs your VPNs and configures every network card. You almost never interact with it directly, but knowing the name helps when something is wrong.
Wi-Fi: connect from the system status menu
Click the system status menu in the top-right of your screen (top-bar on GNOME, system tray on KDE Plasma / XFCE). The drop-down has a Wi-Fi tile. Click it, Linux lists every Wi-Fi network in range with a signal-strength bar. Click yours, type the password, you're online. Linux remembers it, every future time you're in range it reconnects on its own.
Wired Ethernet: plug it in, you're online
Plug in an Ethernet cable. That's it. NetworkManager detects the cable, asks the router for an IP address via DHCP, and you're online in 2-3 seconds. A "Wired Connected" notification slides in at the top. On GNOME, Wi-Fi automatically turns off when wired is plugged in to save battery (KDE Plasma and most other desktops leave both on by default, you can change either way in Settings → Network).
Manual IP setup (rare, only if your IT person gives you fixed addresses): Settings → Network on GNOME (or System Settings → Connections on KDE Plasma) → click the cog / edit next to "Wired" → IPv4 tab → switch from Automatic (DHCP) to Manual → type the address, netmask, gateway and DNS. Click Apply.
Captive portals: hotel and café "I agree" pages
Hotel, café, airport and conference Wi-Fi often makes you click "I agree to the terms" before working. Linux detects these automatically and pops up the login page in a special browser window the moment you connect. Click I agree, you're online. (If the popup doesn't appear: manually go to any plain HTTP site such as http://neverssl.com in your normal browser and the captive page intercepts you.)
VPN: for work, home or privacy
Linux supports every popular VPN style out of the box: OpenVPN, WireGuard, IPsec/IKEv2, L2TP/IPsec, Cisco AnyConnect (openconnect). Setup is once-per-connection in Settings → Network → VPN → + (or System Settings → Connections on KDE Plasma). After that, toggle the connection on and off from the system status menu (top-bar on GNOME, system tray on KDE Plasma / XFCE) the same way you do Wi-Fi.
Cisco AnyConnect / OpenConnect for big company VPNs
Many large corporates and ministries ship Cisco AnyConnect to Windows users. The Linux equivalent is the open-source OpenConnect protocol, same server side, same authentication, just install the NetworkManager OpenConnect plugin first. Install path: open your distro's app store (GNOME Software on Ubuntu / Fedora, Discover on KDE Plasma / Kubuntu, Software Manager on Mint), search "OpenConnect plugin for NetworkManager", click Install. On a work-managed laptop without sudo? Ask IT to push the plugin, it's in most ministry standard images already.
After install, log out / back in (or reboot), then VPN type "Cisco AnyConnect / openconnect" appears in the dropdown in Settings → Network → VPN → +. Type the server URL your IT team gave you, click Connect, and you get the same browser-based login + 2FA prompt as on Windows. Once authenticated, the VPN comes up.
Certificate-based VPN: when work gives you a .p12 file
Some corporate VPNs use a certificate instead of a password. IT will email you a .p12 (or .pfx) file with a passphrase. Linux handles this in the same dialog, when you set up the VPN, pick Authentication: Certificate (TLS), click the file picker next to User Certificate, pick the .p12, type the passphrase. NetworkManager imports the cert into your user keyring and the VPN connects automatically next time.
Where the cert lives: in ~/.cert/ after import. Backed up with your home folder, restoring a backup restores the cert too.
Proxy server: for restricted corporate networks
Some company networks force all internet traffic through a proxy (often called web filter or secure web gateway). On Linux, set it system-wide once: Settings → Network → Network Proxy on GNOME (or System Settings → Network → Proxy on KDE Plasma). Three modes:
- Automatic, you have a PAC file URL (your IT person will tell you). Paste it. Done.
- Manual, type HTTP proxy host:port, HTTPS host:port, FTP host:port, and any "no proxy for" exceptions.
- Disabled, default, direct internet.
Most apps pick the system proxy up automatically. A few command-line tools don't and need a small extra config, ask your IT team, they'll either pre-configure that on the work image or send you the exact lines.
Network diagnostics: when something is wrong
The first place to look is the network icon in the system status menu (top-right). Red triangle = no internet, exclamation = limited connection, solid icon = you're online. Beyond that, three GUI tools cover 95% of problems:
| Symptom | Where to look | What to try |
|---|---|---|
| Wi-Fi keeps disconnecting | Settings → Wi-Fi → click the cog next to the network | Forget the network and re-add it. Or restart Wi-Fi via the status-menu toggle. |
| No internet at all | Settings → Network → Connection details | Check IP address (should be 192.168.x.x or 10.x.x.x). If 169.254.x.x, the router didn't hand out an IP, restart the router or reconnect. |
| VPN connects but no traffic | VPN entry in the status menu, toggle off and on | Some VPNs need "Use this connection only for resources on its network" unticked (in the VPN's IPv4 tab) to route all traffic. |
| Specific website is slow / blocked | Try the site on downforeveryoneorjustme.com or your phone's mobile data | If the site loads for everyone else, it's a network-side issue, try a different network or escalate to IT. |
| DNS-only failure (other sites work) | Settings → Network → IPv4 → switch DNS to 1.1.1.1 | Override the router's DNS server. Reconnect. Most "site won't load" issues go away. |
On KDE Plasma the equivalent panel is System Settings → Connections, same options, slightly different layout. The status-menu network entry is in the system tray rather than the top-bar.
Bonus: The honest answer: what does NOT just work?
Optional, not required for the certificate. Useful if you're buying new networking hardware for yourself, or running into an unusual VPN at home; civil-servant workstations come pre-configured by IT and ministry networks rarely throw these specific edge cases.
Being straight with you. 95% of network setups work out of the box. The short list of what does not:
- Some brand-new Wi-Fi 7 chipsets released in the last few months, driver lands a few weeks behind. Workaround: install the latest HWE (Hardware Enablement) kernel via your distro's update tool / app store, that usually pulls in the newer kernel + driver in one go.
- Some corporate VPNs that require a proprietary client (e.g. older Cisco AnyConnect with a custom auth flow, some Pulse Secure / Ivanti deployments), check with your IT team whether OpenConnect or the modern Ivanti client work; both have Linux builds.
- Mobile broadband / 4G/5G USB dongles, most work, some need an extra ModemManager package from your distro's app store (search "ModemManager" in GNOME Software / Discover / Software Manager). The brand-new 5G modems sometimes lag behind.
- Eduroam at certain universities, the cert chain can be fiddly. Each university has a step-by-step page for Linux; search "eduroam linux [your university]".
For home Wi-Fi, office Ethernet, hotel captive portals, OpenVPN/WireGuard VPNs, web proxies and basic 4G dongles, Linux is as smooth as Windows in 2026. For anything exotic, check linux-hardware.org or your university/company's "Linux instructions" page before relying on it.