Your question answers itself... "create ipset lists before iptables is restored".
The ipset sets must exist before any rules which reference them can be added, as you are aware. They can be empty and populated later, but they must exist. So as you want to do this at boot time arrange your init system to run your ipset create scripts before loading the iptables rules. How that is done is distro specific and subject to much variation/customization.
To get more specific help on how you may do that you should at least provide a better description including your distro, how your iptables rules are initialized, how your ipsets are created and populated, etc.
|