I don't know what the system you've currently implemented is, but just thought I'd let you know about this in case you were unaware. If you enable logging in your dedi's setup.cfg file (i.e. uncomment the line below "// optional: message log file") you can extract IP information from that and reliably (at least I'm pretty sure it's reliable) match IPs to usernames. With logging enabled, when a guest connects you'll get something like this appearing in the log:
Dec 07 01:38:33 Host Auth : 192.168.1.255
Dec 07 01:38:35 Send Track : 192.168.1.255
Dec 07 01:38:35 Connect : 192.168.1.255
Dec 07 01:38:35 A new guest is connecting
Dec 07 01:38:35 amp88 connected (amp88^L)
Dec 07 01:38:38 amp88 disconnected
From that you can match the amp88 username to the 192.168.1.255 IP. Extend your InSim application to include the IP address of the connection. Then when you ban someone from the server (e.g. using a !ban command in your InSim application) it can also add the user's IP address to your IP-specific ban file, along with the normal LFS username based ban. If you want to implement ban ranges you could do that with regexes (in your IP-specific ban file you could identify lines which were custom regexes by starting them with "Re:" or something similar).
The above isn't a perfect solution (because of the file I/O) but it should be decent until IP ban support is included in LFS. I believe you can also read files from the end backwards with some programming languages / OSs, so you could cut down the amount of file I/O that way, perhaps.