update blacklist atomically with `ipset swap`