AdguardTeam/AdGuardHome · error

dhcpv6 ra: icmp.ListenPacket: %w

Error message

dhcpv6 ra: icmp.ListenPacket: %w

What it means

Raised during router-advertisement Init when icmp.ListenPacket("ip6:ipv6-icmp", addr%iface) fails to open the ICMPv6 listening socket. Typical wrapped causes: permission denied (unprivileged process can't open raw ICMPv6 sockets), no IPv6 support in the kernel, or the address/interface not being available. On failure the deferred Close cleans up the partially-initialized RA.

Source

Thrown at internal/dhcpd/routeradv.go:257

		otherConfiguration:          !ra.raSLAACOnly,
		mtu:                         uint32(ra.iface.MTU),
		prefixLen:                   64,
		recursiveDNSServer:          ra.dnsIPAddr,
		sourceLinkLayerAddress:      ra.iface.HardwareAddr,
	}
	params.prefix = make([]byte, 16)
	copy(params.prefix, ra.prefixIPAddr[:8]) // /64

	var data []byte
	data, err = createICMPv6RAPacket(params)
	if err != nil {
		return fmt.Errorf("creating packet: %w", err)
	}

	ipAndScope := ra.ipAddr.String() + "%" + ra.ifaceName
	ra.conn, err = icmp.ListenPacket("ip6:ipv6-icmp", ipAndScope)
	if err != nil {
		return fmt.Errorf("dhcpv6 ra: icmp.ListenPacket: %w", err)
	}

	defer func() {
		if err != nil {
			err = errors.WithDeferred(err, ra.Close())
		}
	}()

	con6 := ra.conn.IPv6PacketConn()

	if err = con6.SetHopLimit(255); err != nil {
		return fmt.Errorf("dhcpv6 ra: SetHopLimit: %w", err)
	}

	if err = con6.SetMulticastHopLimit(255); err != nil {
		return fmt.Errorf("dhcpv6 ra: SetMulticastHopLimit: %w", err)
	}

View on GitHub (pinned to b41aefbe51)

Solutions

1. Grant capabilities: run as root or setcap 'cap_net_raw=eip' on the binary (and NET_ADMIN if needed)
2. Enable IPv6: sysctl -w net.ipv6.disable_ipv6=0 and ensure the interface has an IPv6 address
3. Ensure the RA interface is up before AdGuard Home starts (add ordering dependency in systemd)
4. If IPv6/RA is not needed, disable DHCPv6 and RA in the config so Init is never called

func canOpenICMPv6(iface string) bool {
	c, err := icmp.ListenPacket("ip6:ipv6-icmp", "::%"+iface)
	if err != nil { return false }
	c.Close()
	return true
}

if err := ra.Init(...); err != nil {
    if strings.Contains(err.Error(), "icmp.ListenPacket") {
        if os.IsPermission(err) || strings.Contains(err.Error(), "permission denied") {
            // escalate capabilities or run as root, then retry
        }
        // otherwise IPv6 disabled: skip RA and continue without it
    }
}

When it happens

Trigger: Enabling DHCPv6 RA in a process lacking CAP_NET_RAW or running as non-root on hosts where unprivileged ICMPv6 sockets are disabled (net.ipv4.ping_group_range does not cover ip6:ipv6-icmp usage); IPv6 compiled out (net.ipv6.disable_ipv6=1); interface down at start.

Common situations: Docker containers without NET_RAW; hardened sysctl disabling IPv6; VPS with IPv6 removed; interface brought up after AdGuard Home starts.

Related errors

• converting source link-layer address: %w
• creating packet: %w
• reading db: %w
• resetting dhcpv6 leases: %w
• creating dhcpv6 srv: %w

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/9194e1a55902f2da. Report an issue: GitHub.