Outline of syntax as to how I think bcp38 might work

fw3 takes care of creating the ipsets. This is possibly
bad, as we want to be able to track a double-natted gateway
and allow for its ip and netmask to be passed through.