Story / scenario opener
You boot Fedora and the network icon shows a crossed-out globe. The system tray says "WiFi Disabled by Hardware Switch." You open the settings panel, toggle the wireless switch, and nothing happens. The radio stays dead. This usually means the kernel or a firmware layer intercepted a hardware signal and locked the transmitter.
What's actually happens
Linux treats wireless radios like physical circuit breakers. The kernel exposes a subsystem called rfkill that tracks every wireless adapter, Bluetooth module, and cellular modem. Each device maintains two independent states: soft block and hard block. A soft block is a software toggle. You can flip it from the command line or the desktop settings. A hard block comes from the machine itself. A physical slider, a dedicated button, or a firmware signal from the embedded controller tells the kernel to cut power to the antenna.
When the hard block is active, the kernel ignores software commands. NetworkManager reads the rfkill state before it even attempts to scan for networks. If the kernel reports blocked, NetworkManager refuses to start the interface. The cfg80211 wireless configuration API enforces this at the driver level. The driver will not register the interface as operational until the kernel clears the block flag. Think of it like a main electrical breaker. You can flip the light switch all you want, but if the breaker is tripped, the circuit stays dead.
The embedded controller on modern laptops often manages the hard block state. It watches for physical switches and function keys. When it detects a press, it sends an interrupt to the kernel. The kernel updates the rfkill state and broadcasts a udev event. Desktop environments listen for that event to update the GUI. If the firmware is outdated or the driver does not support the specific hardware switch, the state can get stuck.
Check the kernel ring buffer before you assume the hardware is broken. Firmware interrupts often leave a trace.
The fix
Start by checking the current state. The rfkill command lists every wireless device and its block status. Run it without arguments to see the table.
rfkill list
# WHY: Shows all wireless devices, their indices, and whether they are soft-blocked or hard-blocked.
# WHY: The output uses 1-indexed IDs. You will need the ID if the blanket command fails.
# WHY: Run this as a normal user. Reading radio state does not require elevated privileges.
If the output shows Soft blocked: yes, the system applied a software lock. Clear it with the blanket unblock command.
sudo rfkill unblock wifi
# WHY: Tells the kernel to clear the soft block flag for all devices tagged as WiFi.
# WHY: Requires root because modifying kernel radio state affects system-wide hardware access.
# WHY: The wifi tag matches the type field in the rfkill list output.
NetworkManager caches interface states. Restart the daemon to force it to re-read the kernel status and bring the interface up.
sudo systemctl restart NetworkManager
# WHY: Reloads the network configuration and rescans for available access points.
# WHY: Avoids stale state files that keep the GUI showing a disconnected icon.
# WHY: Use restart instead of reload to guarantee the network stack reinitializes cleanly.
If rfkill list shows Hard blocked: yes, software cannot override it. The machine is holding the switch down. Check for a physical slider on the laptop chassis. Look for a key with an antenna icon, usually in the F1 through F12 row. Press it once, sometimes combined with the Fn key. Wait three seconds. Run rfkill list again. The hard block column should flip to no.
Some laptops require a driver reload after a hard block clears. The kernel module may cache the previous state. Unload and reload the wireless driver to force a fresh hardware handshake.
sudo modprobe -r $(lspci -nnk | grep -iA3 network | grep -oP 'in use: \K[^,]+')
# WHY: Extracts the currently loaded wireless driver name from lspci output.
# WHY: Removes the module from the kernel. Active connections will drop immediately.
# WHY: Only run this if the interface remains dead after clearing the hard block.
sudo modprobe iwlwifi
# WHY: Reinserts the Intel wireless driver. Replace iwlwifi with your actual driver name.
# WHY: Triggers the kernel to reprobe the hardware and read the current rfkill state.
# WHY: The driver will register the interface as UP if the hard block is cleared.
Run journalctl first. Read the actual error before guessing.
Verify it worked
Confirm the radio is active and the interface has an operational state.
ip link show
# WHY: Lists all network interfaces and their operational state.
# WHY: Look for the WiFi interface, typically named wlp or wl, showing state UP.
# WHY: The BROADCAST MULTICAST flags indicate the interface is ready to transmit.
Check the connection manager status to ensure it is scanning for networks.
nmcli device wifi list
# WHY: Queries NetworkManager for visible access points.
# WHY: Returns an empty list if the radio is still blocked or the driver failed to initialize.
# WHY: This command bypasses the GUI and talks directly to the NetworkManager D-Bus API.
If you see your networks listed, the radio is live. Connect using your preferred method. The desktop applet will update automatically.
Trust the package manager. Manual file edits drift, snapshots stay.
Common pitfalls and what the error looks like
The most frequent mistake is confusing soft and hard blocks. Running rfkill unblock wifi does nothing when Hard blocked: yes appears in the output. The kernel enforces the hardware signal at the driver level. Another trap is the rfkill event daemon. Some laptops send asynchronous firmware events that toggle the block state after boot. If your WiFi dies randomly, check the journal for firmware interrupts.
rfkill: input handler enabled
rfkill: hard block changed to 1
These lines appear in journalctl -k. They mean the embedded controller is sending a block signal. You cannot patch this with a configuration file. You must address the hardware switch or update the laptop firmware. SELinux does not block rfkill. The tool runs in the unconfined domain by default. If you see permission denied errors, check your sudo configuration, not the security policy.
NetworkManager also respects the wifi.scan-rand-mac-address setting. If you enabled random MAC addresses and your router blocks unknown clients, the interface will appear connected but drop packets. That is a different problem. Stick to the radio state first. Configuration files in /etc/NetworkManager/ are user-modified. Files in /usr/lib/NetworkManager/ ship with the package. Edit /etc/. Never edit /usr/lib/.
The dnf upgrade --refresh command is the normal weekly maintenance routine. It forces package metadata updates and applies driver fixes. dnf system-upgrade is for crossing major Fedora releases. They are different commands. Don't conflate them. Driver updates often resolve stuck rfkill states.
If the boot menu is gone, GRUB rescue is your friend, not your enemy.
When to use this vs alternatives
Use rfkill unblock wifi when the kernel reports a soft block and the desktop toggle is unresponsive. Use nmcli radio wifi on when you want NetworkManager to manage the state directly through its own API. Use the physical hardware switch or Fn key combination when rfkill list shows a hard block. Use modprobe -r and modprobe for the wireless driver when the interface disappears entirely from rfkill list. Use fwupd to update the laptop firmware when the embedded controller sends erratic hard block signals. Stay on the default NetworkManager configuration if you only need standard desktop connectivity.
Reboot before you debug. Half the time the symptom is gone.