ipset : use only netgroup

only use hash:net for both ips and network.

allow comments and nomatch

delete ipset chains after iptables restore

also optimize hashsize

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>