One can come up with a btree which should reduce the worst case lookup to a max of 8 lookups for a /24.
It'd be better if netfilter supported some way of either binding rules to an interface, or allowing a hashtable-lookup for a "jump" based on IP address.
