You can use ipset to block them. It's hash based and efficient.

http://ipset.netfilter.org/

http://mikhailian.mova.org/node/194