ipset : use only netgroup