Using ipsets (hash table type thing) is much more efficient then iptables rules, especially if you use entire ip blocks