[Unit]
Description=ipset
Before=network-pre.target iptables.service
Wants=network-pre.target

[Service]
Type=oneshot
ExecStart=ipset restore -f /etc/ipset.rules
ExecStop=ipset save -f /etc/ipset.rules ; ipset destroy
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target