Sets at run time add, remove and sync entries without a reload.

$ moat set list --iface eth0
$ moat set show banned --iface eth0
$ moat set add banned 198.51.100.7 --iface eth0 --ttl 1h
$ moat set del banned 198.51.100.7 --iface eth0
$ moat set flush banned --iface eth0
$ moat set sync blocklist blocklist.txt --iface eth0
$ moat var set under_attack true --iface eth0

set add and set del take addresses or prefixes, or - to read them from stdin in the set file format. In an addresses set, --ttl sets exactly the expiry asked for. Without it an entry gets the set's own ttl, if any, and like a rule's add it never shortens an entry that is already there with a later expiry or none.

set sync makes the set equal to a file, adding entries before removing others, so there is no moment when an entry that stays is missing. When the set is too small to hold the old and the new entries together, it removes the leaving ones first. Entries in the file become permanent even if a rule had added them with a ttl.

var set changes a variable on the running program; the next packet already sees the new value. moat var list prints them all.