[IPSET ipfilter-net0] - not working unless I add vm specific firewall rule to only allow traffic from the IPSET