> >>I wonder if we should use special names for ipsets generated by our > >>firewall, something like: “PVEFW-$name” > >> > >>So that we can identify sets generated by our scripts (and do not touch > other sets)? > > Yes,sure,no problem. I'll make a patch You also introduced the new name 'netgroup' - maybe we can simply use 'ipset' instead?