Comment by LinuxBender

Have you considered using ipset so that rules don't have to change and ip's can by dynamically added/removed?