Here you can set up IP-based remote access controls for a particular user.
By default there will be no restricted access. Click on a line in the list to edit its contents. When "Refuse the addresses listed below" is selected you can set an Autoban number. If a given client IP address provides invalid log-in credentials that many times in a row, it will be disallowed next time it tries to connect and automatically added to the list.
These settings can also be set server-wide in the Server Access page.
If server-wide and per-user restrictions are both enabled, the server-wide restrictions are applied before any per-user restrictions. Therefore, you should carefully consider how both lists interact. For example, if you set server-wide access to "Allow only," and also set a particular user's access to "Allow only", then for any host or IP address to successfully connect, it must be provided in both lists. Alternately, if you set server-wide access to "Refuse" an IP address, and for a specific user also "Allow only" that same IP address, the server-wide restriction will be applied first. This combination will effectively prevent the user from logging in at all from any IP address.
See also: Server Access