F2b already does this, but snortsam is compiled in. In order to reduce contention, in ClearOS 7.x you can use the -w switch in iptables. The trouble is that this is snortsam code and not ClearOS code. Once the set is created and the three firewall rules added, the set could be loaded with IP's asynchronously. You'd only need one set which you could reference as source or destination, and three iptables rules (which you could make more efficient by only looking at NEW packets). Much more efficient (and less readable) would be a new module to use ipset sets. Then you need one rule in the INPUT and FORWARD chains to reference the source chain and one in the OUTPUT chain to reference the destination chain (the FORWARD chain could also reference this but it is probably overkill).

The number of rule additions could be dropped by 2/3 by having a new chain with source IP's and an new one with destination IP's. Snort has its iptables handling compiled in which is unfortunate. If that is so, then we are stuck with what we have.

I suspect you are, however, watching the file for changes and using that to trigger the reload. It would still be necessary for deletions and changes. When adding rules this is unnecessary as the rules could be added directly. I believe custom rules work the same way as local rules in that each time the file is changed a firewall restart happens.

Restart iptables