Delete a NetworkManager VPN profile by its reviewed UUID

Start a removal runbook with the list of objects you intend to delete, not with a directory path. NetworkManager's saved profiles may live alongside unrelated networking configuration, and a wildcard delete is not a scoped change. This runbook removes reviewed connection profiles and separates that action from disconnecting, uninstalling or revoking credentials at the gateway. Each query below narrows the scope before anything is removed.

Inventory saved and active connections

Two read queries answer different questions. The first lists saved definitions; the second lists what is active right now. A profile can exist while inactive, and an active temporary connection may have no matching saved profile.

nmcli -f NAME,UUID,TYPE connection show
nmcli connection show --active

Record the UUIDs you intend to remove. Names are not identifiers: two profiles can share one, and a keyfile or interface label may not match the connection at all. Do not select an object because its name starts with a provider label; that pattern also matches connections you want to keep.

Read the type as well. A plugin-managed VPN and a native WireGuard connection can use different type values, so a filter for the generic vpn type is not a complete definition of every tunnel in scope. That is a filter question, not a deletion criterion.

Confirm the exact UUID and the owner

Show one connection at a time and match the UUID against the reviewed list. The UUID is the stable selector; the name is a label that can be edited after the review.

nmcli connection show uuid ACTUAL_UUID

Confirm which component owns the profile. A vendor application may keep its own copy and recreate the NetworkManager profile on its next launch. If the same tunnel appears in two inventories, deleting one copy changes the owner's state but not the other copy.

Identify whether any startup job, dispatcher script or provisioning system refers to the connection. Removing a profile that an automation still expects produces a reconnect loop or a silent fallback, and the deletion looks like a failure of the network rather than a policy conflict.

Disconnect before deleting an active profile

Deletion removes the saved definition; disconnection stops the tunnel. If the connection is active, disconnect it first with the supported action and note anything that depends on the tunnel.

nmcli connection down uuid ACTUAL_UUID

Do not perform the disconnect through your only remote administration path. If the VPN carries your session, stopping it ends your access, and the removal step then has to continue from a local console or another network.

If the goal is only to stop the tunnel temporarily, stop here. Deletion is unnecessary, and a profile removed for a short outage must be rebuilt later with the same credentials and routes. A rebuild is possible only from material you still hold. Decide which case you are in before running the delete.

Delete only the reviewed object

The destructive step takes the UUID from the reviewed list. It is not a preview, and it does not ask for confirmation of the scope beyond the selector you provide.

nmcli connection delete uuid ACTUAL_UUID

For several profiles, repeat the command once per confirmed UUID. Do not pipe an unreviewed text search into a loop. The review is what makes the deletion safe; the command is only the mechanics.

Preserve recovery material before deleting anything you may need again: enrollment instructions, a profile export or a note of the gateway and account. Restoring a deleted profile is a rebuild, not an undo.

Verify the removal and retire the rest separately

Run both inventory queries again. Confirm that the intended profiles are gone, that unrelated Wi-Fi, Ethernet and remaining VPN profiles are still present, and that no active connection still points at the deleted definition.

Then inspect anything the old profile left behind: a dispatcher script, a route, a DNS entry or a startup association. NetworkManager removes the profile, but other components may retain references that now resolve to nothing.

Credential retirement is its own step. A downloaded export, a vendor application's profile, a cached secret and a remote device authorization each have a different owner. Removing the local NetworkManager record does not revoke a copied certificate at the gateway.

Write the removal record with the UUIDs, the inventory output and the remote material that still needs action. That note is what proves the scope of the change when someone later asks why a specific tunnel disappeared.