diff --git a/CHANGELOG.md b/CHANGELOG.md
index 04f61734..b5094c99 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,6 +37,7 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 ### Fixed
 
+- `ipset` entries family validation ([#6420]).
 - Pre-filling the New static lease window with data ([#6402]).
 - Protection pause timer synchronization ([#5759]).
 
@@ -44,6 +45,7 @@ NOTE: Add new changes BELOW THIS COMMENT.
 [#6362]: https://github.com/AdguardTeam/AdGuardHome/issues/6362
 [#6369]: https://github.com/AdguardTeam/AdGuardHome/issues/6369
 [#6402]: https://github.com/AdguardTeam/AdGuardHome/issues/6402
+[#6420]: https://github.com/AdguardTeam/AdGuardHome/issues/6420
 
 [dnsproxy#169] https://github.com/AdguardTeam/dnsproxy/issues/169
 
diff --git a/internal/ipset/ipset_linux.go b/internal/ipset/ipset_linux.go
index e1c3f3fa..68f53dcb 100644
--- a/internal/ipset/ipset_linux.go
+++ b/internal/ipset/ipset_linux.go
@@ -296,6 +296,10 @@ func (m *manager) ipsets(names []string) (sets []props, err error) {
 			return nil, fmt.Errorf("unknown ipset %q", n)
 		}
 
+		if p.family != netfilter.ProtoIPv4 && p.family != netfilter.ProtoIPv6 {
+			return nil, fmt.Errorf("%q unexpected ipset family %q", p.name, p.family)
+		}
+
 		sets = append(sets, p)
 	}