[pepa65]

This should happen in-kernel and is lightning-fast, so should not be an issue. Maybe a pre-netfilter box..?

[72deluxe]

Big iptables lists are indeed incredibly slow; use ipset for large lists instead.