I personally like the r-fx project with apf / bfd firewall . I am using from long time and is great. One of the feature that is missing is that you can not exclude cdir format from bfd. My workarround was to install the grepcidr package and then on line 137 of /usr/local/bfd/bfd to modify it from
CHKHOST_IGNORE=`cat $file | grep -v “#” | grep -w $ATTACK_HOS`
into
CHKHOST_IGNORE=`/usr/bin/grepcidr -f $file <(echo $ATTACK_HOST)`
After this you can add x.x.x.x/y format
