use strict;
use warnings;
use Data::Dumper;

my %rules;

{
    my $r = \my @uncategorised;
    local *_;
    while(<DATA>) {
        if ( /^[[:upper:]]+$/ ) {
            $r = \@{$rules{$_}};
        } else {
            push @$r => $_;
        }
    } 
}

print Dumper \%rules;
__DATA__
INPUT
-p tcp -s 10.0.12.1 -j ACCEPT
FORWARD
-p udp -d 10.0.12.4 -j ACCEPT
OUTPUT
-p tcp -s 10.0..12.5 -j ACCEPT