In August of last year, I was told on the list to use ipsets to add ips to the drop list. Seeing all the traffic on direct chain, should I be going this direction now? Regards, John