You should just drop packets from badguys unless you are planning on great-cannon-of-chinaing something using 301s. `--reject-with tcp-tarpit` may slow this down but it's probably not worth it if they have 10,000 IPs since that sounds like it's probably comming from a rotating proxy "service."