# ipset awall-masquerade
hash:net family inet