Upon bootup, all iptables are lost because the kernel module ip_set is not loaded

Question

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing the iptables init script, but there has to be an out-of-the-box method.

On CentOS/RHEL 6.5, you can install ipset from the base repository. The first line from

yum info

says

IP sets are a framework inside the Linux 2.4.x and 2.6.x kernel, which can be : administered by the ipset utility.

so i was surprised there is a problem with a kernel module:

ip6tables: Loading additional modules: nf_conntrack_netbios_ns ... OK
iptables: Applying firewall rules: iptables-restore v1.4.7: Kernel module ip_set 
is not loaded in.

i have tried both ip-set and ip_set for this module name with no luck:

/etc/sysconfig/iptables-config:
   IPTABLES_MODULES="nf_conntrack_netbios_ns ip_set"

There may also be separate modules for each ipset data structure. In other words, a module just for ipset hash versus ipset bitmap versus ipset list.

modinfo ip_set and other details