Location to store ipset blocklist?

I currently run DD-WRT (Kongac 26190M) on a Netgear AC1450. I have had good luck with my setup, except DD-WRT iptables does not support ipset even with Entware installed. I use a script to block all TOR nodes from my kids which cuts my internet speed by 1/3. I tuned iptables to make the TOR rule only apply to their devices but I want a better solution.

I am considering buying a used Asus RT-AC68U and running Merlin. I found...

Location to store ipset blocklist?