Using ipset

Finally got it to work. Nobody seems to have a complete and accurate solution for my case... So here it is.

 #include <iostream>  
 #include <thread>     // std::thread  
 #include <mutex>     // std::mutex  
 #include <assert.h>  
 extern "C" {  

 // Debian libipset libary is a C library. All the headers  
 // have to be enclosed in extern "C" brackets to have  
 // proper linkage  
 #include <libipset/session.h>      /* ipset_session_* */  
 #include <libipset/data.h>       /* enum ipset_data */  
 #include <libipset/parse.h>       /* ipset_parse_* */  
 #include <libipset/types.h>       /* struct ipset_type */  
 #include <libipset/ui.h>        /* core options, commands */  
 #include <libipset/utils.h>       /* STREQ */  
 }  
 // debian-ipset is not thread-safe. We're using  
 // a mutex to serialize the ipset calls.  
 std::mutex s_ipsetMutex;  
 // We're only adding a command/an element to the set,  
 // so the restore line no. remains 0  
 #define IPSET_SESSION_LINE_NO 0  
 int  
 ipsetAdd(std::string table, std::string set_type, uint32_t interval)  
 {  
  int32_t ret = 0;  
  const struct ipset_type *type = NULL;  
  enum ipset_cmd cmd = IPSET_CMD_ADD;  
  struct ipset_session *session;  
  // debian-ipset calls are not thread-safe. We're adding  
  // a mutex to serialize the calls.  
  s_ipsetMutex.lock();  
  ipset_load_types();  
  // Initialize an ipset session by allocating a session structure  
  // and filling out with the initialization data.  
  session = ipset_session_init(printf);  
  if (session == NULL)  
  {  
   printf("ipsetAdd: Cannot initialize ipset session for "  
     "set_type %s. aborting.\n", set_type.c_str());  
   ret = 1;  
  }  
  else  
  {  
   // Set session lineno to report parser errors correctly   
   ipset_session_lineno(session, IPSET_SESSION_LINE_NO);  
   // Parse string as a setname.  
   // The value is stored in the data blob of the session.  
   ret = ipset_parse_setname(session, IPSET_SETNAME, table.c_str());  
   if (ret == 0)  
   {  
    type = ipset_type_get(session, cmd);  
    if (!type)  
    {  
     printf("ipsetAdd: Failed to get the set type from Kernel "  
       "set_type=%s table=%s sess=%p cmd=%d\n", set_type.c_str(), table.c_str(),  
       session, cmd);  
     ret = 1;  
    }  
    else  
    {  
     // Parse string as a (multipart) element according to the settype.  
     // The value is stored in the data blob of the session.  
     ret = ipset_parse_elem(session, (ipset_opt)type->last_elem_optional,  
                 set_type.c_str());  
     if (ret == 0)  
     {  
      // Put a given kind of data into the data blob and mark the  
      // option kind as already set in the blob.  
      ret = ipset_data_set(ipset_session_data(session), IPSET_OPT_TIMEOUT, &interval);  
      if (!ret)  
      {  
       // Execute a command  
       ret = ipset_cmd(session, cmd, IPSET_SESSION_LINE_NO);  
       if (ret)  
       {  
        printf("ipsetAdd: WARNING: Failed to execute "  
          "IPSET_CMD_ADD command. ipset exists? ret=%d set_type=%s table=%s\n",  
          ret, set_type.c_str(), table.c_str());  
        // Not an error condition  
        ret = 0;  
       }  
      }  
      else  
      {  
       printf("ipsetAdd: Failed to set timeout option. "  
         "ret=%d set_type=%s table=%s\n", ret, set_type.c_str(), table.c_str());  
      }  
     }  
     else  
     {  
      printf("ipsetAdd: Failed to parse element. "  
        "ret=%d set_type=%s table=%s\n", ret, set_type.c_str(), table.c_str());  
     }  
    }  
   }  
   else  
   {  
    printf("ipsetAdd: Failed to parse setname. "  
      "ret=%d set_type=%s table=%s\n", ret, set_type.c_str(), table.c_str());  
   }  
   // Finish the ipset session  
   if (ipset_session_fini(session) != 0)  
   {  
    printf("ipsetAdd: Failed to destroy ipset "  
      "session. ret=%d set_type=%s table=%s\n", ret, set_type.c_str(),  
      table.c_str());  
   }  
  } // else of if (session == NULL)  
  s_ipsetMutex.unlock();  
  return ret;  
 }  
 int main()  
 {  
  ipsetAdd("my_ipset_table", "127.0.0.1,62142,127.0.0.1", 600);  
  return 0;  
 }  


To build it:
$ g++ myipset.cpp -std=c++0x  -lipset -o myipset

Create your ipset first:
$ sudo ipset create my_ipset_table hash:ip,port,ip family inet maxelem 600000

Due to the fact that some of the ipset commands need special
capability to call or get valid return (e.g. ipset_type_get & ipset_cmd), you have to run it as root.
$ sudo myipset

To check it:
$ sudo ipset -l

Here is the C version of the same function:

 #include <stdio.h>  
 #include <pthread.h>       
 #include <assert.h>  
 #include <libipset/session.h>      /* ipset_session_* */  
 #include <libipset/data.h>       /* enum ipset_data */  
 #include <libipset/parse.h>       /* ipset_parse_* */  
 #include <libipset/types.h>       /* struct ipset_type */  
 #include <libipset/ui.h>        /* core options, commands */  
 #include <libipset/utils.h>       /* STREQ */  
 // debian-ipset is not thread-safe. We're using  
 // a mutex to serialize the ipset calls.  
 pthread_mutex_t s_ipsetMutex;  
 // We're only adding a command/an element to to the set,  
 // so the restore line no. remains 0  
 #define IPSET_SESSION_LINE_NO 0  
 int  
 ipsetAdd(char *table, char *set_type, uint32_t interval)  
 {  
  int32_t ret = 0;  
  const struct ipset_type *type = NULL;  
  enum ipset_cmd cmd = IPSET_CMD_ADD;  
  struct ipset_session *session;  
  // debian-ipset calls are not thread-safe. We're adding  
  // a mutex to serialize the calls.  
  pthread_mutex_lock(&s_ipsetMutex);  
  ipset_load_types();  
  // Initialize an ipset session by allocating a session structure  
  // and filling out with the initialization data.  
  session = ipset_session_init(printf);  
  if (session == NULL)  
  {  
   printf("ipsetAdd: Cannot initialize ipset session for "  
     "set_type %s. aborting.\n", set_type);  
   ret = 1;  
  }  
  else  
  {  
   // Set session lineno to report parser errors correctly   
   ipset_session_lineno(session, IPSET_SESSION_LINE_NO);  
   // Parse string as a setname.  
   // The value is stored in the data blob of the session.  
   ret = ipset_parse_setname(session, IPSET_SETNAME, table);  
   if (ret == 0)  
   {  
    type = ipset_type_get(session, cmd);  
    if (!type)  
    {  
     printf("ipsetAdd: Failed to get the set type from Kernel "  
       "set_type=%s table=%s sess=%p cmd=%d\n", set_type, table,  
       session, cmd);  
     ret = 1;  
    }  
    else  
    {  
     // Parse string as a (multipart) element according to the settype.  
     // The value is stored in the data blob of the session.  
     ret = ipset_parse_elem(session, (enum ipset_opt)type->last_elem_optional,  
                 set_type);  
     if (ret == 0)  
     {  
      // Put a given kind of data into the data blob and mark the  
      // option kind as already set in the blob.  
      ret = ipset_data_set(ipset_session_data(session), IPSET_OPT_TIMEOUT, &interval);  
      if (!ret)  
      {  
       // Execute a command  
       ret = ipset_cmd(session, cmd, IPSET_SESSION_LINE_NO);  
       if (ret)  
       {  
        printf("ipsetAdd: WARNING: Failed to execute "  
          "IPSET_CMD_ADD command. ipset exists? ret=%d set_type=%s table=%s\n",  
          ret, set_type, table);  
        // Not an error condition  
        ret = 0;  
       }  
      }  
      else  
      {  
       printf("ipsetAdd: Failed to set timeout option. "  
         "ret=%d set_type=%s table=%s\n", ret, set_type, table);  
      }  
     }  
     else  
     {  
      printf("ipsetAdd: Failed to parse element. "  
        "ret=%d set_type=%s table=%s\n", ret, set_type, table);  
     }  
    }  
   }  
   else  
   {  
    printf("ipsetAdd: Failed to parse setname. "  
      "ret=%d set_type=%s table=%s\n", ret, set_type, table);  
   }  
   // Finish the ipset session  
   if (ipset_session_fini(session) != 0)  
   {  
    printf("ipsetAdd: Failed to destroy ipset "  
      "session. ret=%d set_type=%s table=%s\n", ret, set_type,  
      table);  
   }  
  } // else of if (session == NULL)  
  pthread_mutex_unlock(&s_ipsetMutex);  
  return ret;  
 }