diff --git a/src/Makefile.am b/src/Makefile.am
index a9fbb8ff..f919c2df 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1,10 +1,14 @@
 AM_CFLAGS = -g -O2 -Wall -Werror -Wno-deprecated-declarations -fno-strict-aliasing -std=gnu99 -D_GNU_SOURCE
 AM_CFLAGS += -I$(top_builddir)/libev
 AM_CFLAGS += -I$(top_builddir)/libasyncns
+AM_CFLAGS += -I$(top_builddir)/libipset/include
 
 AM_LDFLAGS = -static
 
-SS_COMMON_LIBS = $(top_builddir)/libev/libev.la $(INET_NTOP_LIB)
+SS_COMMON_LIBS = $(top_builddir)/libev/libev.la \
+				 $(top_builddir)/libcork/libcork.la \
+				 $(top_builddir)/libipset/libipset.la \
+				 $(INET_NTOP_LIB)
  
 bin_PROGRAMS = ss-local ss-tunnel
 
@@ -18,6 +22,7 @@ ss_local_SOURCES = utils.c \
 				   encrypt.c \
 				   udprelay.c \
 				   cache.c \
+				   acl.c \
 				   local.c
 
 ss_tunnel_SOURCES = utils.c \
diff --git a/src/Makefile.in b/src/Makefile.in
index c169302e..0517b207 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -105,17 +105,18 @@ CONFIG_CLEAN_VPATH_FILES =
 am__installdirs = "$(DESTDIR)$(bindir)"
 PROGRAMS = $(bin_PROGRAMS)
 am__ss_local_SOURCES_DIST = utils.c jconf.c json.c encrypt.c \
-	udprelay.c cache.c local.c win32.c
+	udprelay.c cache.c acl.c local.c win32.c
 @BUILD_WINCOMPAT_TRUE@am__objects_1 = ss_local-win32.$(OBJEXT)
 am_ss_local_OBJECTS = ss_local-utils.$(OBJEXT) \
 	ss_local-jconf.$(OBJEXT) ss_local-json.$(OBJEXT) \
 	ss_local-encrypt.$(OBJEXT) ss_local-udprelay.$(OBJEXT) \
-	ss_local-cache.$(OBJEXT) ss_local-local.$(OBJEXT) \
-	$(am__objects_1)
+	ss_local-cache.$(OBJEXT) ss_local-acl.$(OBJEXT) \
+	ss_local-local.$(OBJEXT) $(am__objects_1)
 ss_local_OBJECTS = $(am_ss_local_OBJECTS)
 am__DEPENDENCIES_1 =
 am__DEPENDENCIES_2 = $(top_builddir)/libev/libev.la \
-	$(am__DEPENDENCIES_1)
+	$(top_builddir)/libcork/libcork.la \
+	$(top_builddir)/libipset/libipset.la $(am__DEPENDENCIES_1)
 ss_local_DEPENDENCIES = $(am__DEPENDENCIES_2)
 AM_V_lt = $(am__v_lt_@AM_V@)
 am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
@@ -338,11 +339,16 @@ top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 AM_CFLAGS = -g -O2 -Wall -Werror -Wno-deprecated-declarations \
 	-fno-strict-aliasing -std=gnu99 -D_GNU_SOURCE \
-	-I$(top_builddir)/libev -I$(top_builddir)/libasyncns
+	-I$(top_builddir)/libev -I$(top_builddir)/libasyncns \
+	-I$(top_builddir)/libipset/include
 AM_LDFLAGS = -static
-SS_COMMON_LIBS = $(top_builddir)/libev/libev.la $(INET_NTOP_LIB)
+SS_COMMON_LIBS = $(top_builddir)/libev/libev.la \
+				 $(top_builddir)/libcork/libcork.la \
+				 $(top_builddir)/libipset/libipset.la \
+				 $(INET_NTOP_LIB)
+
 ss_local_SOURCES = utils.c jconf.c json.c encrypt.c udprelay.c cache.c \
-	local.c $(am__append_2)
+	acl.c local.c $(am__append_2)
 ss_tunnel_SOURCES = utils.c jconf.c json.c encrypt.c udprelay.c \
 	cache.c tunnel.c $(am__append_3)
 ss_server_SOURCES = utils.c \
@@ -477,6 +483,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/jconf.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/json.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/redir.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_local-acl.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_local-cache.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_local-encrypt.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_local-jconf.Po@am__quote@
@@ -610,6 +617,20 @@ ss_local-cache.obj: cache.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_local_CFLAGS) $(CFLAGS) -c -o ss_local-cache.obj `if test -f 'cache.c'; then $(CYGPATH_W) 'cache.c'; else $(CYGPATH_W) '$(srcdir)/cache.c'; fi`
 
+ss_local-acl.o: acl.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_local_CFLAGS) $(CFLAGS) -MT ss_local-acl.o -MD -MP -MF $(DEPDIR)/ss_local-acl.Tpo -c -o ss_local-acl.o `test -f 'acl.c' || echo '$(srcdir)/'`acl.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/ss_local-acl.Tpo $(DEPDIR)/ss_local-acl.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='acl.c' object='ss_local-acl.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_local_CFLAGS) $(CFLAGS) -c -o ss_local-acl.o `test -f 'acl.c' || echo '$(srcdir)/'`acl.c
+
+ss_local-acl.obj: acl.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_local_CFLAGS) $(CFLAGS) -MT ss_local-acl.obj -MD -MP -MF $(DEPDIR)/ss_local-acl.Tpo -c -o ss_local-acl.obj `if test -f 'acl.c'; then $(CYGPATH_W) 'acl.c'; else $(CYGPATH_W) '$(srcdir)/acl.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/ss_local-acl.Tpo $(DEPDIR)/ss_local-acl.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='acl.c' object='ss_local-acl.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_local_CFLAGS) $(CFLAGS) -c -o ss_local-acl.obj `if test -f 'acl.c'; then $(CYGPATH_W) 'acl.c'; else $(CYGPATH_W) '$(srcdir)/acl.c'; fi`
+
 ss_local-local.o: local.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_local_CFLAGS) $(CFLAGS) -MT ss_local-local.o -MD -MP -MF $(DEPDIR)/ss_local-local.Tpo -c -o ss_local-local.o `test -f 'local.c' || echo '$(srcdir)/'`local.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/ss_local-local.Tpo $(DEPDIR)/ss_local-local.Po
diff --git a/src/acl.c b/src/acl.c
new file mode 100644
index 00000000..c6912f73
--- /dev/null
+++ b/src/acl.c
@@ -0,0 +1,7 @@
+#include <ipset/ipset.h>
+
+struct ip_set *init_acl(void)
+{
+    struct ip_set *ipset = ipset_new();
+    return ipset;
+}