diff --git a/docs/ipsets.xml b/docs/ipsets.xml
index bc15bbd62..af3b1058c 100644
--- a/docs/ipsets.xml
+++ b/docs/ipsets.xml
@@ -159,6 +159,17 @@ ACCEPT net:+sshok $FW tcp 22
setting SAVE_IPSETS to a comma-separated list of ipset names. You can also
restrict the group of sets saved to ipv4 sets by setting
SAVE_IPSETS=ipv4.
+
+ With Shorewall 4.6.4, the SAVE_IPSETS option may specify a list of
+ ipsets to be saved. When such a list is specified, only those ipsets
+ together with the ipsets supporting dynamic zones are saved. Shorewall6
+ support for the SAVE_IPSETS option was also added in 4.6.4. When
+ SAVE_IPSETS=Yes in shorewall6.conf(5), only ipv6
+ ipsets are saved. For Shorewall, if SAVE_IPSETS=ipv4 in shorewall.conf(5), then only
+ ipv4 ipsets are saved. Both features require ipset version 5 or
+ later.
@@ -169,7 +180,7 @@ ACCEPT net:+sshok $FW tcp 22
Beginning with Shorewall 4.6.4, SAVE_IPSETS is available in shorewall6-conf(5). When set
to Yes, the ipv6 ipsets will be set. You can also save selective ipsets by
- setting SAVE_IPSETS to a comma-separated list of ipset names.
+ setting SAVE_IPSETS to a comma-separated list of ipset names.
Prior to Shorewall 4.6.4, SAVE_IPSETS=Yes in shorewall.conf won't
work correctly because it saves both IPv4 and IPv6 ipsets. To work around