{"record":{"id":"b0c6cc00264411c0","repo":"AdguardTeam/AdGuardHome","slug":"dialing-netfilter-w","errorCode":null,"errorMessage":"dialing netfilter: %w","messagePattern":"dialing netfilter: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/ipset/ipset_linux.go","lineNumber":396,"sourceCode":"\n\t\tlogger: conf.Logger,\n\n\t\tdial: dial,\n\n\t\taddedIPs: container.NewMapSet[ipInIpsetEntry](),\n\t}\n\n\terr = m.dialNetfilter(&netlink.Config{})\n\tif err != nil {\n\t\tif errors.Is(err, unix.EPROTONOSUPPORT) {\n\t\t\t// The implementation doesn't support this protocol version.  Just\n\t\t\t// issue a warning.\n\t\t\tm.logger.WarnContext(ctx, \"dialing netfilter\", slogutil.KeyError, err)\n\n\t\t\treturn nil, nil\n\t\t}\n\n\t\treturn nil, fmt.Errorf(\"dialing netfilter: %w\", err)\n\t}\n\n\terr = m.parseIpsetConfig(ctx, conf.Lines)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"getting ipsets: %w\", err)\n\t}\n\n\tm.logger.DebugContext(ctx, \"initialized\")\n\n\treturn m, nil\n}\n\n// lookupHost find the ipsets for the host, taking subdomain wildcards into\n// account.\nfunc (m *manager) lookupHost(host string) (sets []props) {\n\t// Search for matching ipset hosts starting with most specific domain.\n\t// We could use a trie here but the simple, inefficient solution isn't\n\t// that expensive: ~10 ns for TLD + SLD vs. ~140 ns for 10 subdomains on","sourceCodeStart":378,"sourceCodeEnd":414,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/ipset/ipset_linux.go#L378-L414","documentation":"Top-level wrap when initializing the ipset manager: the initial netfilter dial/list operation failed and the error was not the ignorable/warnable kind. The inner error is the real cause (often 380/381 or a list query failure).","triggerScenarios":"newManagerWithDialer performs an initial netfilter interaction that errors; non-transient failures are returned as 'dialing netfilter: <err>'.","commonSituations":"Missing CAP_NET_ADMIN, netlink socket limits (nlbufsiz), or kernel without ipset support; the warn-and-continue path was not taken.","solutions":["Run with CAP_NET_ADMIN / root","Confirm kernel ipset support and load nfnetlink/ipset modules","Inspect the wrapped inner error for the precise syscall failure"],"exampleFix":"sudo setcap cap_net_admin+ep /path/to/AdGuardHome","handlingStrategy":"validation","validationCode":"if os.Geteuid() != 0 && !hasCapNetAdmin() {\n\tlog.Fatal(\"ipset requires CAP_NET_ADMIN\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n\tif strings.Contains(err.Error(), \"dialing netfilter\") {\n\t\tlog.Warn(\"ipset unsupported here; continuing without it\")\n\t} else { return err }\n}","preventionTips":["Grant CAP_NET_ADMIN in container/unit files","Verify 'ipset list' works in the deployment environment"],"tags":["ipset","netfilter","initialization"],"backgroundTag":"netfilter-permission-denied","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}