AdguardTeam/AdGuardHome · error

getting ipsets: %w

Error message

getting ipsets: %w

What it means

Wraps a failure while parsing and resolving the ipset config lines (see 384/385/387) during manager creation. The inner error identifies the bad line or missing set.

Source

Thrown at internal/ipset/ipset_linux.go:401

		addedIPs: container.NewMapSet[ipInIpsetEntry](),
	}

	err = m.dialNetfilter(&netlink.Config{})
	if err != nil {
		if errors.Is(err, unix.EPROTONOSUPPORT) {
			// The implementation doesn't support this protocol version.  Just
			// issue a warning.
			m.logger.WarnContext(ctx, "dialing netfilter", slogutil.KeyError, err)

			return nil, nil
		}

		return nil, fmt.Errorf("dialing netfilter: %w", err)
	}

	err = m.parseIpsetConfig(ctx, conf.Lines)
	if err != nil {
		return nil, fmt.Errorf("getting ipsets: %w", err)
	}

	m.logger.DebugContext(ctx, "initialized")

	return m, nil
}

// lookupHost find the ipsets for the host, taking subdomain wildcards into
// account.
func (m *manager) lookupHost(host string) (sets []props) {
	// Search for matching ipset hosts starting with most specific domain.
	// We could use a trie here but the simple, inefficient solution isn't
	// that expensive: ~10 ns for TLD + SLD vs. ~140 ns for 10 subdomains on
	// an AMD Ryzen 7 PRO 4750U CPU; ~120 ns vs. ~ 1500 ns on a Raspberry
	// Pi's ARMv7 rev 4 CPU.
	for i := 0; ; i++ {
		host = host[i:]
		sets = m.domainToIpsets[host]

View on GitHub (pinned to b41aefbe51)

Solutions

1. Read the inner error for line index and cause
2. Fix the config line or create the missing ipset
3. Restart the service

if err := mgr.Start(ctx); err != nil {
	if inner := errors.Unwrap(err); inner != nil { log.Printf("ipset config problem: %v", inner) }
	return err
}

When it happens

Trigger: parseIpsetConfig returns an error for any config line: bad syntax, empty name, unknown set, or failed header query.

Common situations: Misformatted YAML ipset lines or references to sets not created on the host.

Related errors

• invalid value %q: expected one slash
• invalid value %q: empty ipset name
• config line at idx %d: %w
• getting ipsets from config line at idx %d: %w
• unknown ipset %q

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/8a21da7e9e3fc27e. Report an issue: GitHub.