Jason, I use ipsets and have written scripts for handling them dynamically. I think this is a very interesting idea. I'd benefit from hearing some elaboration on the use cases you have in mind. I think this might also help Simon understand how best to integrate.