AdguardTeam/AdGuardHome · error

dialing netfilter: %w

Error message

dialing netfilter: %w

What it means

Top-level wrap when initializing the ipset manager: the initial netfilter dial/list operation failed and the error was not the ignorable/warnable kind. The inner error is the real cause (often 380/381 or a list query failure).

Source

Thrown at internal/ipset/ipset_linux.go:396

		logger: conf.Logger,

		dial: dial,

		addedIPs: container.NewMapSet[ipInIpsetEntry](),
	}

	err = m.dialNetfilter(&netlink.Config{})
	if err != nil {
		if errors.Is(err, unix.EPROTONOSUPPORT) {
			// The implementation doesn't support this protocol version.  Just
			// issue a warning.
			m.logger.WarnContext(ctx, "dialing netfilter", slogutil.KeyError, err)

			return nil, nil
		}

		return nil, fmt.Errorf("dialing netfilter: %w", err)
	}

	err = m.parseIpsetConfig(ctx, conf.Lines)
	if err != nil {
		return nil, fmt.Errorf("getting ipsets: %w", err)
	}

	m.logger.DebugContext(ctx, "initialized")

	return m, nil
}

// lookupHost find the ipsets for the host, taking subdomain wildcards into
// account.
func (m *manager) lookupHost(host string) (sets []props) {
	// Search for matching ipset hosts starting with most specific domain.
	// We could use a trie here but the simple, inefficient solution isn't
	// that expensive: ~10 ns for TLD + SLD vs. ~140 ns for 10 subdomains on

View on GitHub (pinned to b41aefbe51)

Solutions

1. Run with CAP_NET_ADMIN / root
2. Confirm kernel ipset support and load nfnetlink/ipset modules
3. Inspect the wrapped inner error for the precise syscall failure

Example fix

sudo setcap cap_net_admin+ep /path/to/AdGuardHome

if os.Geteuid() != 0 && !hasCapNetAdmin() {
	log.Fatal("ipset requires CAP_NET_ADMIN")
}

if err != nil {
	if strings.Contains(err.Error(), "dialing netfilter") {
		log.Warn("ipset unsupported here; continuing without it")
	} else { return err }
}

When it happens

Trigger: newManagerWithDialer performs an initial netfilter interaction that errors; non-transient failures are returned as 'dialing netfilter: <err>'.

Common situations: Missing CAP_NET_ADMIN, netlink socket limits (nlbufsiz), or kernel without ipset support; the warn-and-continue path was not taken.

Related errors

• dialing v4: %w
• dialing v6: %w
• getting ipsets: %w
• unexpected family %s for ipset %q
• %q %q unexpected family %q

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/b0c6cc00264411c0. Report an issue: GitHub.