firewall: improve ipset support