Iwd

iwd (iNet wireless daemon) is a Linux-only wireless daemon aiming to decrease the time spent making connections.

Setup

iwd can be enabled with the following snippet.

networking.wireless.iwd.enable = true;

Usage

Connections can be managed using the provided iwctl tool.

Configuration

To configure iwd, you should use networking.wireless.iwd.settings option. An example configuration, which enables IPv6 and automatic connection to known networks, would be similar to:

{
  networking.wireless.iwd.settings = {
    Network = {
      EnableIPv6 = true;
    };
    Settings = {
      AutoConnect = true;
    };
  };
}

For a detailed and up-to-date list of available settings, please reference the network daemon configuration documentation, from kernel Git repo.

Eduroam (WPA2 Enterprise) network

Eduroam wireless networks need to get configured manually by creating the following file /var/lib/iwd/eduroam.8021x, which will not persist across NixOS rebuilds unless explicitly managed. It's often better to configure this via a NixOS module.

[Security]
EAP-Method=PEAP
EAP-Identity=eduroamHDcat2024@uni-heidelberg.de
EAP-PEAP-CACert=/var/lib/iwd/ca.pem
EAP-PEAP-ServerDomainMask=radius-node1.urz.uni-heidelberg.de
EAP-PEAP-Phase2-Method=MSCHAPV2
EAP-PEAP-Phase2-Identity=xyz123@uni-heidelberg.de
EAP-PEAP-Phase2-Password=mypassword

[Settings]
Autoconnect=true

Replace the values in EAP-Identity, EAP-PEAP-ServerDomainMask, EAP-PEAP-Phase2-Identity and EAP-PEAP-Phase2-Password according to your university presets which can be acquired at cat.eduroam.org. After entering your university name there the site will offer you a download link to a Python script which contains most of the required default values. The script also contains a certificate string which can be copied into the file /var/lib/iwd/ca.pem.

iwd as backend for NetworkManager

If iwd is present, it can be used as a backend for NetworkManager through the following snippet.

networking.networkmanager.wifi.backend = "iwd";

⚠︎

Warning: Setting this will silently turn off MAC address randomization as Networkmanager does not control the MAC address randomization features of `iwd` for which it is turned off by default. To remediate this, configure iwd directly using the `AddressRandomization` option.

iwd as backend for Connman

iwd could be used as a backend for Connman too.

services.connman.wifi.backend = "iwd";

Note that iwd is experimental and it does not have feature parity with the default backend, wpa_supplicant.

Troubleshooting

org.freedesktop.service failed

When connecting to a protected network it could happen that no password window appears and the following message is written in the journal:

dbus-daemon[1732]: [session uid=9001 pid=1730] Activated service 'org.freedesktop.secrets' failed: Failed to execute program org.freedesktop.secrets: No such file or directory

Your desktop manager may not enable some secrets management service you may need to enable one:

{
  services.gnome.gnome-keyring.enable = true;
}

rfkill blocks wireless device

If the Wi-Fi connection is blocked by rfkill, it needs to unblock the wireless device. A way to do that in NixOS is by using system.activationScripts, although it is not the most idiomatic solution.

{
  system.activationScripts = {
    rfkillUnblockWlan = {
      text = ''
        rfkill unblock wlan
      '';
      deps = [];
    };
  };
}

event: disconnect-info reason: 2

When using certain chipsets, such as the Qualcomm qcncm865, you need to use legacy EAPoL packets to prevent a disconnect loop. In iwd.service this issue shows up as:

SA Query timed out, connection is invalid.  Disconnecting...
Feb 26 10:17:10 probook iwd[4486]: event: disconnect-info, reason: 2

If you are using systemd-networkd, this shows up in systemd-networkd.service as repeated Carrier Gained. Carrier Lost. messages. On NixOS, this can be resolved by setting the matching iwd settings option.

{
  networking.wireless.iwd.settings.General.ControlPortOverNL80211 = false;
}