add ipset support

This is a rebased version of #348 and a fix for MODULES-1173.
Should we mention that it requires ipset kernel support to function?