Thanks for all of your ideas! I have succeeded in restricting access to a range of IP addresses. In case someone wants to do the country based filtering, the code below for firewall.user solved my issue 
...
Unfortunately there is a small glitch left in the filter 
, as I did not really understood the FORWARD concept.
Here's the problem:
I am running transmission on a laptop machine connected to my router.
Opening a zone_wan_forward port to --dport 51413 enables transmission up/dowload on the laptop (and transmission diagnostics reports port open)
As soon as I enable zone_wan filters by IPrange, all packet that does not match zone_wan filters are dropped (however I thought they would pass because of the forwarding rule) Transmission diagnostics reports port closed.
Syslog says the dropped packet's destination is the router, not the laptop behind it. The forwarding rule did not change.
What cause this behavior? How could I do a work-around?
#!/bin/sh
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
### Allow all traffic from hungary (hu) Use ISO code separated by space ###
ISO="hu"
### Set PATH ###
IPT=/usr/sbin/iptables
WGET=/usr/bin/wget
EGREP=/bin/egrep
### No editing below ###
ACCEPTLIST="countryok"
ZONEROOT="/root/iptables"
DLROOT="http://www.ipdeny.com/ipblocks/data/countries"
cleanOldRules(){
$IPT -F $ACCEPTLIST
}
# create a dir
[ ! -d $ZONEROOT ] && /bin/mkdir -p $ZONEROOT
# clean old rules
cleanOldRules
# create a new iptables list
$IPT -N $ACCEPTLIST
for c in $ISO
do
# local zone file
tDB=$ZONEROOT/$c.zone
# get fresh zone file
$WGET -O $tDB $DLROOT/$c.zone
# country specific log message
SPAMDROPMSG="External IP Drop"
# get
GOODIPS=$(egrep -v "^#|^$" $tDB)
for ipaccept in $GOODIPS
do
$IPT -A $ACCEPTLIST -s $ipaccept -j RETURN
done
done
# Allow transmission
$IPT -A $ACCEPTLIST -p tcp -m tcp --dport 51413 -j RETURN
$IPT -A $ACCEPTLIST -p udp -m udp --dport 51413 -j RETURN
# Log and Drop everything else
$IPT -A $ACCEPTLIST -j LOG --log-prefix "$SPAMDROPMSG"
$IPT -A $ACCEPTLIST -j DROP
$IPT -I zone_wan -j $ACCEPTLIST
exit 0
