AdguardTeam/AdGuardHome · error

adding %q%s to %q %q: %w

Error message

adding %q%s to %q %q: %w

What it means

The netlink conn.Add call failed while adding resolved IP entries to the named ipset. Wraps the kernel error with set name, set type, and the host/IPs involved.

Source

Thrown at internal/ipset/ipset_linux.go:474

	n = len(entries)
	if n == 0 {
		return 0, nil
	}

	var conn ipsetConn
	switch set.family {
	case netfilter.ProtoIPv4:
		conn = m.ipv4Conn
	case netfilter.ProtoIPv6:
		conn = m.ipv6Conn
	default:
		return 0, fmt.Errorf("unexpected family %s for ipset %q", set.family, set.name)
	}

	err = conn.Add(set.name, entries...)
	if err != nil {
		return 0, fmt.Errorf("adding %q%s to %q %q: %w", host, ips, set.name, set.typeName, err)
	}

	// Only add these to the cache once we're sure that all of them were
	// actually sent to the ipset.
	for _, e := range newAddedEntries {
		s := m.nameToIpset[e.ipsetName]
		if s.isPersistent {
			m.addedIPs.Add(e)
		}
	}

	return n, nil
}

// addToSets adds the IP addresses to the corresponding ipset.
func (m *manager) addToSets(
	ctx context.Context,
	host string,

View on GitHub (pinned to b41aefbe51)

Solutions

1. Check 'ipset list <name>' still exists and its maxelem/headers
2. Increase maxelem when creating the set, or prune entries
3. Ensure sets aren't destroyed by concurrent firewall scripts

Example fix

# before
ipset create myset hash:ip
# after
ipset create myset hash:ip maxelem 1000000

out, err := exec.Command("ipset", "list", set).Output()
if err != nil { /* set missing; recreate before proceeding */ }

if err != nil && strings.Contains(err.Error(), "adding") {
	log.Warnf("ipset add failed: %v; will retry next update cycle", err)
}

When it happens

Trigger: Adding entries to set 'name' of typeName fails: set destroyed meanwhile, entry already exists in a set without -exist semantics, netlink timeout, or memory limits of the set (maxelem).

Common situations: Set removed by firewall reload mid-run, hash set full (maxelem reached), ENOBUFS on a busy netlink socket.

Related errors

• unexpected ipset family %q
• %q %q making header query: %w
• dialing v4: %w
• dialing v6: %w
• invalid value %q: expected one slash

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/5855332ed6885469. Report an issue: GitHub.