diff --git a/npc/ipset/ipset.go b/npc/ipset/ipset.go
index 1e57b1d7..63516fd9 100644
--- a/npc/ipset/ipset.go
+++ b/npc/ipset/ipset.go
@@ -1,6 +1,7 @@
 package ipset
 
 import (
+	"fmt"
 	"log"
 	"os/exec"
 	"strings"
@@ -40,6 +41,7 @@ type entryKey struct {
 type ipset struct {
 	*log.Logger
 	enableComments bool
+	maxListSize    int
 	// List of users per ipset entry. User is either a namespace or a pod.
 	// There might be multiple users for the same ipset & entry pair because
 	// events from k8s API server might be out of order causing duplicate IPs:
@@ -47,10 +49,11 @@ type ipset struct {
 	users map[entryKey]map[types.UID]struct{}
 }
 
-func New(logger *log.Logger) Interface {
+func New(logger *log.Logger, maxListSize int) Interface {
 	ips := &ipset{
 		Logger:         logger,
 		enableComments: true,
+		maxListSize:    maxListSize,
 		users:          make(map[entryKey]map[types.UID]struct{}),
 	}
 
@@ -71,6 +74,9 @@ func New(logger *log.Logger) Interface {
 
 func (i *ipset) Create(ipsetName Name, ipsetType Type) error {
 	args := []string{"create", string(ipsetName), string(ipsetType)}
+	if ipsetType == ListSet && i.maxListSize > 0 {
+		args = append(args, fmt.Sprintf("size %d", i.maxListSize))
+	}
 	if i.enableComments {
 		args = append(args, "comment")
 	}
diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go
index 01b5266c..92764699 100644
--- a/prog/weave-npc/main.go
+++ b/prog/weave-npc/main.go
@@ -31,6 +31,7 @@ var (
 	allowMcast  bool
 	nodeName    string
 	legacy      bool
+	maxList     int
 )
 
 func handleError(err error) { common.CheckFatal(err) }
@@ -152,7 +153,7 @@ func root(cmd *cobra.Command, args []string) {
 	ipt, err := iptables.New()
 	handleError(err)
 
-	ips := ipset.New(common.LogLogger())
+	ips := ipset.New(common.LogLogger(), maxList)
 
 	handleError(resetIPTables(ipt))
 	handleError(resetIPSets(ips))
@@ -245,6 +246,7 @@ func main() {
 	rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic")
 	rootCmd.PersistentFlags().StringVar(&nodeName, "node-name", "", "only generate rules that apply to this node")
 	rootCmd.PersistentFlags().BoolVar(&legacy, "use-legacy-netpol", false, "use legacy network policies (pre k8s 1.7 vsn)")
+	rootCmd.PersistentFlags().IntVar(&maxList, "max-list-size", 1024, "maximum size of ipset list (for namespaces)")
 
 	handleError(rootCmd.Execute())
 }