why is there a iptable input drop rule and a ipset in this?

please rewrite i this script so that it does the exact same thing it currently does (but block the IP's with ipset, remove iptables), but way more efficiently.:

```
package main

import (
	"fmt"
	"log"
	"os/exec"
	"sync"
	"time"

	"github.com/google/gopacket"
	"github.com/google/gopacket/layers"
	"github.com/google/gopacket/pcap"
)

const (
	PACKET_THRESHOLD = 50
	SYN_THRESHOLD    = 10
	RST_THRESHOLD    = 10
	ACK_THRESHOLD    = 10
	TIME_WINDOW      = 5 * time.Second
)

var whitelist = map[string]bool{
	"IP": true,
	"IP": true,
}

var mu sync.Mutex
var packetCounts = make(map[string]int)
var blockedIPs = make(map[string]bool)

func createMatchSet() {
	cmd := exec.Command("ipset", "create", "blocked_ips", "hash:ip")
	output, err := cmd.CombinedOutput()
	if err != nil {
		log.Println("Error creating ipset:", err)
		log.Println(string(output))
	}
}

func addIPToMatchSet(ip string) {
	if blockedIPs[ip] {
		return
	}

	cmd := exec.Command("ipset", "add", "blocked_ips", ip, "-exist")
	output, err := cmd.CombinedOutput()
	if err != nil {
		if string(output) != "ipset v7.19: Element cannot be added to the set: it's already added\n" {
			log.Println("Error adding IP to match set:", err)
			log.Println(string(output))
		}
	} else {
		blockedIPs[ip] = true
		fmt.Printf("Blocked IP address: %s\n", ip)
	}
}

func blockMatchSet() {
	cmd := exec.Command("iptables", "-I", "INPUT", "-m", "set", "--match-set", "blocked_ips", "src", "-j", "DROP")
	output, err := cmd.CombinedOutput()
	if err != nil {
		log.Println("Error blocking match set:", err)
		log.Println(string(output))
	}
}

func main() {
	handle, err := pcap.OpenLive("ens3", 1600, true, pcap.BlockForever)
	if err != nil {
		log.Fatal(err)
	}
	defer handle.Close()
	createMatchSet()
	go func() {
		ticker := time.NewTicker(TIME_WINDOW)
		defer ticker.Stop()
		for range ticker.C {
			mu.Lock()
			packetCounts = make(map[string]int)
			mu.Unlock()
		}
	}()

	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
	for packet := range packetSource.Packets() {
		ipLayer := packet.Layer(layers.LayerTypeIPv4)
		if ipLayer == nil {
			continue
		}
		ipAddr := ipLayer.(*layers.IPv4).SrcIP

		// Skip whitelisted IPs
		if whitelist[ipAddr.String()] {
			continue
		}

		mu.Lock()
		packetCounts[ipAddr.String()]++
		if packetCounts[ipAddr.String()] > PACKET_THRESHOLD {
			addIPToMatchSet(ipAddr.String())
		}
		mu.Unlock()

		tcpLayer := packet.Layer(layers.LayerTypeTCP)
		if tcpLayer != nil {
			tcpPacket := tcpLayer.(*layers.TCP)
			if tcpPacket.SYN {
				mu.Lock()
				packetCounts[ipAddr.String()+"-SYN"]++
				if packetCounts[ipAddr.String()+"-SYN"] > SYN_THRESHOLD {
					addIPToMatchSet(ipAddr.String())
				}
				mu.Unlock()
			} else if tcpPacket.RST {
				mu.Lock()
				packetCounts[ipAddr.String()+"-RST"]++
				if packetCounts[ipAddr.String()+"-RST"] > RST_THRESHOLD {
					addIPToMatchSet(ipAddr.String())
				}
				mu.Unlock()
			} else if tcpPacket.ACK {
				mu.Lock()
				packetCounts[ipAddr.String()+"-ACK"]++
				if packetCounts[ipAddr.String()+"-ACK"] > ACK_THRESHOLD {
					addIPToMatchSet(ipAddr.String())
				}
				mu.Unlock()
			}
		}
	}
} 
```