diff --git a/net/bridge.go b/net/bridge.go
index a3b0fd41..2f6d641f 100644
--- a/net/bridge.go
+++ b/net/bridge.go
@@ -507,7 +507,7 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error {
 	// `"externalTrafficPolicy":"Local"` would receive packets with correct
 	// src IP addr.
 	if config.NoMasqLocal {
-		ips := ipset.New(common.LogLogger())
+		ips := ipset.New(common.LogLogger(), 0)
 		_ = ips.Destroy(NoMasqLocalIpset)
 		if err := ips.Create(NoMasqLocalIpset, ipset.HashNet); err != nil {
 			return err
diff --git a/net/ipset/ipset.go b/net/ipset/ipset.go
index 37488008..b538a6c9 100644
--- a/net/ipset/ipset.go
+++ b/net/ipset/ipset.go
@@ -3,6 +3,7 @@ package ipset
 import (
 	"crypto/rand"
 	"encoding/hex"
+	"fmt"
 	"log"
 	"os/exec"
 	"strings"
@@ -43,6 +44,7 @@ type entryKey struct {
 type ipset struct {
 	*log.Logger
 	enableComments bool
+	maxListSize    int
 	// List of users per ipset entry. User is either a namespace or a pod.
 	// There might be multiple users for the same ipset & entry pair because
 	// events from k8s API server might be out of order causing duplicate IPs:
@@ -50,10 +52,11 @@ type ipset struct {
 	users map[entryKey]map[types.UID]struct{}
 }
 
-func New(logger *log.Logger) Interface {
+func New(logger *log.Logger, maxListSize int) Interface {
 	ips := &ipset{
 		Logger:         logger,
 		enableComments: true,
+		maxListSize:    maxListSize,
 		users:          make(map[entryKey]map[types.UID]struct{}),
 	}
 
@@ -81,6 +84,9 @@ func New(logger *log.Logger) Interface {
 
 func (i *ipset) Create(ipsetName Name, ipsetType Type) error {
 	args := []string{"create", string(ipsetName), string(ipsetType)}
+	if ipsetType == ListSet && i.maxListSize > 0 {
+		args = append(args, "size", fmt.Sprintf("%d", i.maxListSize))
+	}
 	if i.enableComments {
 		args = append(args, "comment")
 	}
diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go
index d5ffb17b..d9922de9 100644
--- a/prog/weave-npc/main.go
+++ b/prog/weave-npc/main.go
@@ -31,6 +31,7 @@ var (
 	allowMcast  bool
 	nodeName    string
 	legacy      bool
+	maxList     int
 )
 
 func handleError(err error) { common.CheckFatal(err) }
@@ -152,7 +153,7 @@ func root(cmd *cobra.Command, args []string) {
 	ipt, err := iptables.New()
 	handleError(err)
 
-	ips := ipset.New(common.LogLogger())
+	ips := ipset.New(common.LogLogger(), maxList)
 
 	handleError(resetIPTables(ipt))
 	handleError(resetIPSets(ips))
@@ -245,6 +246,7 @@ func main() {
 	rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic")
 	rootCmd.PersistentFlags().StringVar(&nodeName, "node-name", "", "only generate rules that apply to this node")
 	rootCmd.PersistentFlags().BoolVar(&legacy, "use-legacy-netpol", false, "use legacy network policies (pre k8s 1.7 vsn)")
+	rootCmd.PersistentFlags().IntVar(&maxList, "max-list-size", 1024, "maximum size of ipset list (for namespaces)")
 
 	handleError(rootCmd.Execute())
 }
diff --git a/prog/weaver/main.go b/prog/weaver/main.go
index f91ff893..79c1b65a 100644
--- a/prog/weaver/main.go
+++ b/prog/weaver/main.go
@@ -307,7 +307,7 @@ func main() {
 
 	bridgeConfig.Mac = name.String()
 	bridgeConfig.Port = config.Port
-	ips := ipset.New(common.LogLogger())
+	ips := ipset.New(common.LogLogger(), 0)
 	bridgeType, err := weavenet.EnsureBridge(procPath, &bridgeConfig, Log, ips)
 	checkFatal(err)
 	Log.Println("Bridge type is", bridgeType)
diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh
index 4feab89d..cd8829fe 100755
--- a/test/840_weave_kube_3_test.sh
+++ b/test/840_weave_kube_3_test.sh
@@ -225,12 +225,39 @@ run_on $HOST1 "$KUBECTL delete netpol allow-nettest-deny"
 # nettest-deny should still not be able to reach nettest pods
 assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
 
-# allow access for all
+# Create many namespaces to stress namespaceSelector
+for n in 1 2 3 4 5 6 7 8 9 10; do
+    run_on $HOST1 "$KUBECTL create namespace namespace${n}"
+done
+
+# allow access from any namespace
 run_on $HOST1 "$KUBECTL apply -f -" <<EOF
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: allow-nettest-deny
+  name: allow-any-namespace
+  namespace: default
+spec:
+  podSelector: {}
+  ingress:
+    - from:
+      - namespaceSelector: {}
+EOF
+
+# Should be able to access from the "deny" pod now
+assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
+
+# host should still not be able to reach pods via service virtual IP or NodePort
+# because host is not in a namespace
+assert_raises "! $SSH $HOST1 curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null"
+assert_raises "! $SSH $HOST1 curl -s -S -f -m 2 http://$HOST2:31138/status >/dev/null"
+
+# allow access from anywhere
+run_on $HOST1 "$KUBECTL apply -f -" <<EOF
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-anywhere
   namespace: default
 spec:
   podSelector: {}
@@ -238,8 +265,6 @@ spec:
     - {}
 EOF
 
-assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
-
 # Virtual IP and NodePort should now work
 assert_raises "$SSH $HOST1 curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null"
 assert_raises "$SSH $HOST1 curl -s -S -f -m 2 http://$HOST2:31138/status >/dev/null"