GL-MT6000 (Flint 2): AdGuard Home fails after 4.11 upgrade, and stays broken after rolling back to 4.9.1 (ipset.conf missing)

Router
1

Device: GL-MT6000 (Flint 2)
Firmware: 4.9.1 (release1, build 0804) → 4.11 → rolled back to 4.9.1
AdGuard Home: 0.107.73 (bundled)

What happened

I upgraded from 4.9.1 to 4.11 with settings kept. AdGuard Home stopped working on 4.11, so I rolled back to 4.9.1. After the rollback AdGuard Home still wouldn't start. The AdGuard page in the admin panel showed 0 queries, and DNS was down for every device on the network, since the router redirects all port 53 traffic to AdGuard.

The error

AdGuard Home crash-loops on startup. logread shows:

[fatal] dnsServer.Prepare: preparing ipset settings: open /var/run/AdGuardHome/ipset.conf: no such file or directory
procd: Instance adguardhome::instance1 s in a crash loop 6 crashes, 0 seconds since last crash

The AdGuard config has always contained:

ipset_file: /var/run/AdGuardHome/ipset.conf

/var/run is in RAM and cleared on every boot. Before the upgrade, something created this file at boot and AdGuard started fine, surviving several reboots over weeks. After the 4.11 round-trip, nothing creates it and AdGuard fatals every boot.

What I checked

  • The AdGuard config itself is intact (schema 33, all rules and clients present)
  • My pre-upgrade backup contains the identical ipset_file setting and nothing that creates the file, so restoring the backup doesn't fix it
  • On 4.9.1, nothing references /var/run/AdGuardHome/ apart from the AdGuard binary itself. /etc/init.d/adguardhome doesn't create it, and neither does domain_ipset_config.lua (which writes /var/run/dnsmasq/via_domain)
  • No leftover 4.11 files appear to be overriding the firmware in the overlay
  • Side effect: the rollback also removed /etc/AdGuardHome/backup/

Workaround

An empty file is enough. Domain-based VPN policy routing still works, because the domain→ipset tagging is handled by dnsmasq's via_domain, not this file. I added this to /etc/rc.local, before exit 0. rc.local runs from S95done, before S99adguardhome:

# AdGuard Home aborts at startup if this file is missing; /var/run is wiped each boot
mkdir -p /var/run/AdGuardHome
touch /var/run/AdGuardHome/ipset.conf

After a full reboot, AdGuard started on its own with no crashes, DNS and blocking worked, and VPN domain policies were routing correctly.

Questions for GL.iNet

  1. What is supposed to create /var/run/AdGuardHome/ipset.conf at boot on 4.9.1?
  2. Is this a known issue with 4.11's AdGuard integration, and will 4.11 or later handle it?
  3. Could the init script create the file (or AdGuard treat a missing ipset_file as empty) rather than failing fatally? A missing optional file currently takes DNS down for the entire network.
2

The log isolates the immediate failure: the bundled AdGuard Home is given a non-empty ipset_file path and treats the missing runtime file as fatal. Your idempotent mkdir/touch workaround is reasonable as a temporary mitigation, but it may be removed by a factory reset and should be rechecked after firmware changes.

I could not verify an official statement identifying which 4.9.1 component should generate this file or confirming this as a known 4.11 issue. The decisive diagnostic would be a clean 4.11 installation without retaining settings, enabling AdGuard Home before restoring any backup. If the file is still absent, that points to the stock 4.11 integration; if AdGuard starts, it points to retained or migrated configuration. This test erases the router configuration and interrupts connectivity, so only perform it after exporting a backup and ensuring you have local recovery access. Otherwise, your report already contains a focused reproduction for GL.iNet staff to investigate whether the init process should create the file or omit ipset_file when unused.

This reply was generated by AI. Please verify its accuracy.

GL.iNet Technical Support reviews and responds to relevant threads on business days. Please allow time for a staff response.

3

Hi,

Have you followed this guide to configure the ipset feature in AdGuard Home so that domain-based VPN policy routing continues to work when AdGuard Home Handle Client Requests is enabled?