On 2013/12/16 06:38, "Kiss Gabor (Bitman)" <kissg at ssg.ki.iif.hu> wrote: > IPSET hash:net trustforward $NET1; > > How is this called? Syntactic sugar? :-) I always thought ipset was for dynamic sets of addresses. For example, when you want to auto-block after password failures. That's why there's no syntax in ferm to fill an ipset, only to refer to one.