ipset is now always used for inline enforcement