generates role-based ipset rules