You might not have to use the whole snapshot, from 23.03.5, I just took 3 files from snapshot which seemed to be dependencies
dnsmasq is the DNS/DHCP server that comes standard in OpenWRT.
The package shipped with OpenWrt, dnsmasq is a minimal compile omitting certain features
ipset support allows dnsmasq to dynamically add the results of dns lookups to netfilter ipsets, which can later be used in firewall rules to permit or deny traffic.
Replace the minimal version with the full version
opkg update
opkg remove dnsmasq
mv /etc/config/dhcp /etc/config/dhcp.bak
opkg install dnsmasq-full
As of openWRT 23.0.5 Jul 17, 2023 could not get dnsmasq-full working in a container, only works in a virtual machine. Probably something small
As of openWRT 23.0.5 Jul 17, 2023 the version of dnsmasq-full that comes with the distribution is 2.86. This version while it supports ipsets does not support nfsets
root@OpenWrt:~# dnsmasq -v
Dnsmasq version 2.86 Copyright (c) 2000-2021 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth cryptohash DNSSEC no-ID loop-detect inotify dumpfile
OpenWrt has shifted focus from iptsbles to nftables so we prefer to use nfset support as opposed to ipset support
Download a newer version of dnsmasq-full from the openWRT snapshots repository and 2 of it's dependencies
The fact that it's in snapshot, means that releases after 23.0.x will not need to do this bit.
Also the filenames might change but the base path will probably stay the same
wget https://downloads.openwrt.org/snapshots/packages/x86_64/base/libubox20230523_2023-05-23-75a3b870-1_x86_64.ipk
wget https://downloads.openwrt.org/snapshots/packages/x86_64/base/libubus20220615_2022-06-15-9913aa61-1_x86_64.ipk
wget https://downloads.openwrt.org/snapshots/packages/x86_64/base/dnsmasq-full_2.89-4_x86_64.ipk
Install the packages
opkg install libubox20230523_2023-05-23-75a3b870-1_x86_64.ipk
opkg install libubus20220615_2022-06-15-9913aa61-1_x86_64.ipk
opkg install dnsmasq-full_2.89-4_x86_64.ipk
Now we have dnsmasq-full 2.89 which supports nfsets
root@OpenWrt:~# dnsmasq -v
Dnsmasq version 2.89 Copyright (c) 2000-2022 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP conntrack no-ipset nftset auth cryptohash DNSSEC no-ID loop-detect inotify dumpfile