Create a new ipset that uses network blocks (as apposed to individual IPs)
firewall-cmd --permanent --new-ipset=geo-blacklist --type=hash:net --option=family=inet --option=hashsize=4096 --option=maxelem=200000Add the ipset as a source
firewall-cmd --permanent --zone=drop --add-source=ipset:geo-blacklistImport a list of networks
firewall-cmd --permanent --ipset=geo-blacklist --add-entries-from-file=./cn.zoneAdd a single entry
firewall-cmd --permanent --ipset=geo-blacklist --add-entry=1.1.1.1Remove an entry
firewall-cmd --permanent --ipset=geo-blacklist --remove-entry=1.1.1.1firewall-cmd --get-ipsetsShow details of an ipset
firewall-cmd --permanent --info-ipset=geo-blacklist