Ipset-extras issues in 25.12.0

Installing and Using OpenWrt
1

With 25.12.0, the ipset-extras stopped working with previously good configs. The error message happens at the firewall reload step

uci set dhcp.us="ipset"
uci add_list dhcp.us.name="US"
uci add_list dhcp.us.name="US6"
uci add_list dhcp.us.geoip="us"
uci commit dhcp

ipset setup

openwrt /etc/init.d/firewall restart /dev/stdin:23413:4-18: Error: Could not process rule: File exists 23.162.208.0/24

If you delete the offending IP address from the text file, and it will find another it doesn't like. You can repeat that deleting, for at least past my patience level, without success,

This config worked with RC2 (I think) but I didn't catch exactly when it stopped.

It still works on the previous stable.

Any thoughts?

2

Started having issues in 24 too about a month later. This is all in an incus / lxc so it may be specific to that.

I deployed on Inucs/ Linux instance with nft and got the error "netlink: Error: Could not process rule: Message too long Please, rise /proc/sys/net/core/wmem_max on the host namespace" so it may be related.

The answer on linux was to add

net.core.wmem_max=4194304
net.core.wmem_default=524288

to sysctl.

3
  • How large is the ipset?
  • How are you configuring the list and adding the rule in OpenWrt?
4

It's large. The corresponding US.ipv4 from dbip is almost 64k lines. I configured it with:

opkg update
opkg install ipset resolveip


# Install ipset-extras via their install script
wget -U "" -O ipset-extras.sh "https://openwrt.org/_export/code/docs/guide-user/advanced/ipset_extras?codeblock=0"
chmod +x ipset-extras.sh
./ipset-extras.sh

# Logout and back in to enable the extension from the /etc/profile.d folder
exit

# Configure an IP set for the US
uci set dhcp.us="ipset"
uci add_list dhcp.us.name="US"
uci add_list dhcp.us.name="US6"
uci add_list dhcp.us.geoip="us"
uci commit dhcp

# Populate IP sets
ipset setup

# Check set creation worked
nft list sets

# Install hotplug-extras for persistence
wget -U "" -O hotplug-extras.sh "https://openwrt.org/_export/code/docs/guide-user/advanced/hotplug_extras?codeblock=0"
chmod +x ./hotplug-extras.sh
./hotplug-extras.sh

The symptom in the gui is that firewall changes silently fail to commit. If you're doing it at the command line you get an error message when restarting the firewall service as noted above.