Inverse CIDR whitelist
GolfScript, 120 (136 characters - 16 bonus)
n%{':'-{48^71%}%16base}%-1+2.7??:W+${\)1$1$-{}{129,-1%{2\?.2$)&lt;3$@%!&amp;}?:~2$W+16base(;{.48+\9&gt;39*+}%4/':'*'/'+128@-+puts\2~?+\2~?-}/;;}*;

Assumes the addresses as separate lines on STDIN. A considerable amount of the code is actually used to input/output in the correct format. The algorithm itself is quite simple and described here.