ipset and --permanent

Hello!

I would like to understand when and why I need --permanent when using ipsets.

My goal is the following: fail2ban should ban IPs via the ipset option through firewalld. I want this way because I prefer to have all firewall stuff at one place.

I've now deleted a permanent ipset, and it still resides in the runtime. Although, I can't delete it from the runtime.

m@zbook:~$ sudo firewall-cmd --permanent --new-ipset=test --type=hash:ip --family=inet success m@zbook:~$ sudo firewall-cmd --delete-ipset=test --permanent success m@zbook:~$ sudo firewall-cmd --get-ipsets test m@zbook:~$ sudo firewall-cmd --get-ipsets --permanent

m@zbook:~$

What is the preferred way to handle that?