I justed test vms ipset, and it don't apply here. (don't see iptables rule or ipset created). Can you tell me where are the firewall compiler debug/warn logs ?