We did the same thing in one of our apps and the approach we took was to create a custom HttpHandler which was wired up to the Application_BeginRequest
event.
Inside the handler we grabbed the IP address of the request by doing HttpContext.Current.Request.UserHostAddress
and then performed a check against our list of blocked IP addresses. The blocked IP's are all stored in the database but we also hold a cached copy in memory in the server to avoid trips to the database on every request.
There is a pretty good article on MSDN about creating a custom HTTP Module Walkthrough: Creating and Registering a Custom HTTP Module
For what it's worth we store the IP's as strings in the DB but there is some good info on the best format to use in the posts already added.