AlmaLinux 9 network-scripts migration to NetworkManager keyfiles

Direct answer

On AlmaLinux 9, custom routing that cannot be expressed as static routes in a keyfile should be implemented as a systemd unit ordered after network-online.target, not as a legacy ifup-local hook. Manually created keyfiles are applied only when they are owned by root:root, have mode 0600, and are loaded into NetworkManager via nmcli connection load or a daemon restart.

Confirmed facts vs. likely explanation

Confirmed for AlmaLinux 9: the legacy network-scripts package and the network service are absent by default; NetworkManager reads INI keyfiles from /etc/NetworkManager/system-connections/; and the daemon ignores keyfiles with incorrect ownership or permissions.

Likely explanation: logic that depends on interface state but cannot be modeled with ipv4.routes or a dispatcher script often needs a systemd service with After=network-online.target and Wants=network-online.target, because dispatcher scripts are intended for event-driven reactions rather than arbitrary shell logic. Complex conditional routing moved into dispatcher scripts can introduce race conditions if the interface state changes during execution.

Steps for this case

1. Move standard routes into the keyfile using ipv4.routes and ipv6.routes. Inspect the current profile with nmcli connection show <name>.
2. For custom logic, create a systemd unit (for example, /etc/systemd/system/custom-routing.service) with After=network-online.target. Do not rely on /etc/sysconfig/network-scripts/ hooks.
3. If the logic must react to link events, place an executable script in /etc/NetworkManager/dispatcher.d/. Keep it idempotent and fast; avoid long-running commands.
4. For manual keyfiles, enforce strict permissions and ownership:

   chown root:root /etc/NetworkManager/system-connections/<file>
   chmod 600 /etc/NetworkManager/system-connections/<file>

5. Load the profile without rebooting:

   nmcli connection load /etc/NetworkManager/system-connections/<file>
   nmcli connection up <name>

Verification

• ls -l /etc/NetworkManager/system-connections/ to confirm root ownership and -rw-------.
• nmcli connection show to verify the profile is present and active.
• nmcli connection down up <name> to test that the profile and any associated dispatcher logic run cleanly.

Missing diagnostic detail: What specific routing behavior cannot be represented by ipv4.routes or a dispatcher script? If it is policy-based routing or routing rules, the recommendation shifts from a systemd unit to keyfile routing-rule directives, which should be verified against the installed NetworkManager version on AlmaLinux 9.