implement ipset as an alternative to raw, now that ipset has long been in the mainline kernel
configure the default mechanism in the conf file, not in the script