diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac65bf5f..1d53dd12 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -36,12 +36,14 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 ### Fixed
 
+- `ipset` entries family validation ([#6420]).
 - Pre-filling the New static lease window with data ([#6402]).
 - Protection pause timer synchronization ([#5759]).
 
 [#5759]: https://github.com/AdguardTeam/AdGuardHome/issues/5759
 [#6369]: https://github.com/AdguardTeam/AdGuardHome/issues/6369
 [#6402]: https://github.com/AdguardTeam/AdGuardHome/issues/6402
+[#6420]: https://github.com/AdguardTeam/AdGuardHome/issues/6420
 
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
diff --git a/internal/ipset/ipset_linux.go b/internal/ipset/ipset_linux.go
index e1c3f3fa..68f53dcb 100644
--- a/internal/ipset/ipset_linux.go
+++ b/internal/ipset/ipset_linux.go
@@ -296,6 +296,10 @@ func (m *manager) ipsets(names []string) (sets []props, err error) {
 			return nil, fmt.Errorf("unknown ipset %q", n)
 		}
 
+		if p.family != netfilter.ProtoIPv4 && p.family != netfilter.ProtoIPv6 {
+			return nil, fmt.Errorf("%q unexpected ipset family %q", p.name, p.family)
+		}
+
 		sets = append(sets, p)
 	}