For this type of connection bias filter, the best way to do this to via your firewall.
I believe some firewalls accept the usage of RBL (real-time block lists) when validating incoming connections. Obviously, it would add additional load on your firewall but that's the place to do it.