Applying IPSet in Lede - iptables

Question

I have been having trouble setting ipset based on host address. Here are the steps I followed with little success recently:
1. Apply list of host to /etc/dnsmasq.conf like this
ipset=/somehost.com/myipset
2. Created ipset using
ipset -n myipset hash:ip (also tried with hash:net)
3.May be the ipsets are getting created, I do not know how to validate this. However when i run
ipset list myipset
Name: myipset
Type: hash:ip
Revision: 4
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 88
References: 0
Members:
Members being blank and Reference being '0' seems to indicate that there are no ipsets being formed.
What I have done already:
Saved ipset creation in a startup script to ensure the ipset is created on boot-up
Tried restarting dnsmasq followed by firewall
Tried booting up the router.
Installed dnsmasq-full, ipset packages additionally in LEDE
I do remember this reference going up in Lede v17.01.3, now I use 17.01.4. I do not recollect what I did differently to make this reference reflect correctly.

Answer 1

Indeed, the default dnsmasq package on LEDE doesn't provide ipset extenstion. You have to use the package dnsmasq-full instead.
You have to create your ipset before a query is made, idealy before dnsmasq is started.
# ipset -N myipset hash:ip
Dnsmasq will fill myipset when you make a DNS query on facebook.com (or a subdomain), you have to add this command on your /etc/dnsmasq.conf :
ipset=/.facebook.com/myipset
You need to restart dnsmasq at this point, then this simple command is enough to fill your ipset
# ping facebook.com
on either the router (provided that you keep 127.0.0.1 as a nameserver on the router /etc/resolv.conf) or on a client of the router (that uses the router as a DNS of course).
Alternatively, you can do this command on the router, it will give you the address(es) given by dnsmasq:
# nslookup facebook.com 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53
Name: facebook.com
Address 1: 157.240.1.35
Address 2: 2a03:2880:f129:83:face:b00c::25de
After that dnsmasq will fill your ipset:
# ipset -L myipset
Name: whitelist_domain
Type: hash:ip
Revision: 4
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 100
References: 2
Members:
157.240.1.35