AdguardTeam/AdGuardHome · error

dialing v4: %w

Error message

dialing v4: %w

What it means

Raised when the ipset manager fails to open a netfilter socket for the IPv4 protocol during initialization. The manager dials both v4 and v6 netfilter connections; failure on the v4 dial aborts manager creation. Almost always indicates the process lacks CAP_NET_ADMIN or the kernel netfilter subsystem is unavailable.

Source

Thrown at internal/ipset/ipset_linux.go:219

}

// ipInIpsetEntry is the type for entries in [manager.addIPs].
type ipInIpsetEntry struct {
	ipsetName string
	// TODO(schzen):  Use netip.Addr.
	ipArr [net.IPv6len]byte
}

// dialNetfilter establishes connections to Linux's netfilter module.
func (m *manager) dialNetfilter(conf *netlink.Config) (err error) {
	// The kernel API does not actually require two sockets but package
	// github.com/digineo/go-ipset does.
	//
	// TODO(a.garipov): Perhaps we can ditch package ipset altogether and just
	// use packages netfilter and netlink.
	m.ipv4Conn, err = m.dial(netfilter.ProtoIPv4, conf)
	if err != nil {
		return fmt.Errorf("dialing v4: %w", err)
	}

	m.ipv6Conn, err = m.dial(netfilter.ProtoIPv6, conf)
	if err != nil {
		return fmt.Errorf("dialing v6: %w", err)
	}

	return nil
}

// parseIpsetConfigLine parses one ipset configuration line.
func parseIpsetConfigLine(confStr string) (hosts, ipsetNames []string, err error) {
	confStr = strings.TrimSpace(confStr)
	hostsAndNames := strings.Split(confStr, "/")
	if len(hostsAndNames) != 2 {
		return nil, nil, fmt.Errorf("invalid value %q: expected one slash", confStr)
	}

View on GitHub (pinned to b41aefbe51)

Solutions

1. Run the binary with CAP_NET_ADMIN (docker: --cap-add=NET_ADMIN, or set cap on the binary)
2. Verify ipset support: 'lsmod | grep ip_set' or 'ipset list' works on the host
3. Disable the ipset feature in config if the environment cannot support it

Example fix

# before
docker run adguard/adguardhome
# after
docker run --cap-add=NET_ADMIN adguard/adguardhome

func canUseNetfilter() bool {
	conn, err := netlink.Dial(netlink.NETLINK_NETFILTER, nil)
	if err != nil {
		return false
	}
	_ = conn.Close()
	return true
}

err := mgr.Start(); if err != nil && strings.Contains(err.Error(), "dialing v4") { log.Warn("netfilter unavailable; disabling ipset") }

When it happens

Trigger: Calling newManager/newManagerWithDialer on a host where socket(AF_NETLINK, NETLINK_NETFILTER) fails for ProtoIPv4: missing capabilities in a container, netfilter modules not loaded, or a restricted seccomp/apparmor profile.

Common situations: Running AdGuard Home in Docker without NET_ADMIN capability, running in an unprivileged LXC container, running on a kernel built without netfilter/ipset modules.

Related errors

• dialing v6: %w
• dialing netfilter: %w
• unexpected family %s for ipset %q
• %q %q unexpected family %q
• networksetup failed to configure dns servers: %w

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/0c05ac53f3ac6584. Report an issue: GitHub.