Using an effective iptables blacklist

I've migrated my mail and web services from a FreeBSD/PF environment to Linux/iptables (CentOS 5.3).  

Being relatively new to iptables, I sought a pre-configured setup to facilitate a quicker rollout - I found a script called "ipkungfu" (which is no longer being developed).   This post is not about that script, so much as it is a question about how to utilize iptables effectively.

Along with my configuration I have a few tables of IPs (mostly /24's) from my PF configuration, tables of:  abuse, spammers and geoip.   The abuse table are IPs that I never, ever want touching any services on my system.  Spammers, blocked from port 25.  Geoip, is generally no access as well.

Iptables has three basic initial chains:

INPUT
FORWARD
OUTPUT

I set up a custom script that would do a for-next loop through the IPs and do something like this:

$iptables -I abuse -s $i -j DROP

I found this isn't working.  I also found that loading large IP lists into iptables is painfully slow (it was lightning fast under FreeBSD/PF).

One particularly annoying host from netsync.net had been slamming my system repeatedly.  The IP was in the DROP directive, but it was getting through anyway.  This, I thought, was due to the fact that some of my services are FORWARDed to an internal host and thus perhaps bypassing something.   I was able to block this host by issuing this command:

# iptables -A FORWARD -s 208.20.34.161 -j DROP
# iptables -A FORWARD -s 208.20.34.150 -j DROP

So my predicament is in correctly understanding how to effectively block these large lists of IPs.  Some of them are BOTNETs some of them are /24's that are dynamic that have shown other patterns of abuse.  Because my server is private, I don't need to be concerned about inadvertently blocking someone.

First, is there a more effective way to block these lists in iptables?  Is there a more efficient way to load these large lists of IPs into the chain(s)?  At this point, it actually causes my system boot time to lag significantly.

Where is the best place to block these IPs in the chains and why doesn't just blocking it in the INPUT chain work.  Or did I configure the DROP incorrectly?

Thanks!

1:
2:
3:
4:
5:
6:
7:

iptables -N abuse
 
 
        for i in `cat $dir/abuse | egrep -hv "^#|$^"`
        do
                $iptables -I abuse -s $i -j DROP
        done