Couldn't it just, when it receives a magic packet for a specific mac address, check if the wol device list contains a matching device and after verifying, that magic packet proxying is enabled for that device, etherwake it just like the wake button on the gui does?
The difference to just forwarding the magic packet from the router straight to that device would be that the magic packet is broadcastet instead of redirected to a specific ip which allows it to wake devices that are off.
What I meant by proxying was doing the same thing you already do with virtual machines but instead of waking a virtual machine you send an etherwake to the right device. And since you have the device list, you could add a toggle to each device to enable this proxy functionality so you have a whitelist feature already built in.