Shorewall can automatically manage the contents of your ipsets for you. If you specify SAVE_IPSETS=Yes in /etc/shorewall/shorewall.conf then "shorewall save" will save the contents of your ipsets. The file where the sets are saved is formed by taking the name where the Shorewall configuration is stored and appending "-ipsets". So if you enter the command "shorewall save standard" then Shorewall will save the file as /var/lib/shorewall/standard-ipsets

Regardless of the setting of SAVE_IPSETS, the shorewall -f start and shorewall restore commands will restore the ipset contents corresponding to the Shorewall configuration restored provided that the saved Shorewall configuration specified exists.

For example, shorewall restore standard would restore the ipset contents from /var/lib/shorewall/standard-ipsets provided that /var/lib/shorewall/standard exists and is executable and that /var/lib/shorewall/standard-ipsets exists and is executable.

Also regardless of the setting of SAVE_IPSETS, the shorewall forget command will purge the saved ipset information (if any) associated with the saved shorewall configuration being removed.

You can also associate ipset contents with Shorewall configuration directories using the following command:

ipset -S > <config directory>/ipsets

Example:

ipset -S > /etc/shorewall/ipsets

When you start or restart Shorewall (including using the try command) from the configuration directory, your ipsets will be configured from the saved ipsets file. Once again, this behavior is independent of the setting of SAVE_IPSETS.

As mentioned above, ipsets are well suited for large blacklists. You can maintain your blacklist using the 'ipset' utility without ever having to restart or refresh Shorewall. If you use the SAVE_IPSETS=Yes feature just be sure to "shorewall save" after altering the blacklist ipset(s).

Shorewall is now out of the ipset load/reload business. With scripts generated by the Perl-based Compiler, the Netfilter rule set is never cleared. That means that there is no opportunity for Shorewall to load/reload your ipsets since that cannot be done while there are any current rules using ipsets.

So:

1. Your ipsets must be loaded before Shorewall starts. You are free to try to do that with the following code in /etc/shorewall/init (it works for me; your mileage may vary):

   if [ "$COMMAND" = start ]; then
       ipset -U :all: :all:
       ipset -U :all: :default:
       ipset -F
       ipset -X
       ipset -R < /etc/shorewall/ipsets
   fi

   The file /etc/shorewall/ipsets will normally be produced using the ipset -S command.

   The above will work most of the time but will fail in a shorewall stop - shorewall start sequence if you use ipsets in your routestopped file (see below).

2. Your ipsets may not be reloaded until Shorewall is stopped or cleared.

3. If you specify ipsets in your routestopped file then Shorewall must be cleared in order to reload your ipsets.

As a consequence, scripts generated by the Perl-based compiler will ignore /etc/shorewall/ipsets and will issue a warning if you set SAVE_IPSETS=Yes in shorewall.conf.