AdguardTeam/AdGuardHome · critical

validating tcp ports: %w

Error message

validating tcp ports: %w

What it means

The set of TCP ports used by the web interface, DNS-over-TLS, and DNS-over-HTTPS has an invalid combination (duplicate or out-of-range values) according to tcpPorts.Validate().

Source

Thrown at internal/home/config.go:781

	udpPorts := aghalg.UniqChecker[udpPort]{}
	addPorts(udpPorts, udpPort(config.DNS.Port))

	if config.TLS.Enabled {
		addPorts(
			tcpPorts,
			tcpPort(config.TLS.PortHTTPS),
			tcpPort(config.TLS.PortDNSOverTLS),
			tcpPort(config.TLS.PortDNSCrypt),
		)

		// TODO(e.burkov):  Consider adding a udpPort with the same value when
		// we add support for HTTP/3 for web admin interface.
		addPorts(udpPorts, udpPort(config.TLS.PortDNSOverQUIC))
	}

	if err = tcpPorts.Validate(); err != nil {
		return fmt.Errorf("validating tcp ports: %w", err)
	} else if err = udpPorts.Validate(); err != nil {
		return fmt.Errorf("validating udp ports: %w", err)
	}

	if !filtering.ValidateUpdateIvl(config.Filtering.FiltersUpdateIntervalHours) {
		config.Filtering.FiltersUpdateIntervalHours = 24
	}

	if len(config.Users) == 0 {
		l.WarnContext(ctx, "no users in the configuration file; authentication is disabled")
	}

	if config.Language != "" && !allowedLanguages.Has(config.Language) {
		l.WarnContext(ctx, "unsupported language", "lang", config.Language)

		// Clear the language so the frontend can use the client's browser
		// language.
		config.Language = ""

View on GitHub (pinned to b41aefbe51)

Solutions

1. Make http_port, port_dns_over_tls and port_dns_over_https distinct valid ports (e.g. 80/3000, 853, 443)
2. Re-run with the setup wizard or reset ports to defaults if unsure
3. Check the wrapped validation error for which port set failed

Example fix

# before
http_port: 443
tls:
  port_dns_over_https: 443
# after
http_port: 3000
tls:
  port_dns_over_https: 443

// Ensure TCP ports are unique and in range before applying config
ports := []int{cfg.HTTPPort, cfg.TLS.PortDNSOverTLS, cfg.TLS.PortDNSOverHTTPS}
seen := map[int]bool{}
for _, p := range ports {
    if p < 1 || p > 65535 || seen[p] { return errors.New("bad tcp ports") }
    seen[p] = true
}

When it happens

Trigger: Config where http_port, tls port_dns_over_tls, and/or port_dns_over_https collide or contain values outside 1-65535.

Common situations: Hand-edited YAML assigning the same port to HTTP and DoT/DoH, ports below 1024 without privileges intended, typos like 853853 or 0.

Related errors

• validating udp ports: %w
• dns.bind_hosts at index %d is not a valid ip address
• override_tls_ciphers: %w
• networksetup failed to set dns servers: %w
• found no dns servers in %s

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/ca97b9b4c7015be0. Report an issue: GitHub.