Here you can setup IP based remote access controls. By default there will be no restricted access. just click on a line in the list to edit its contents. When "Refuse the addresses listed below" is selected you can set an Autoban number. If a given client IP address provides invalid log-in credentials that many times in a row, it will be disallowed next time it tries to connect and added to the list.
These settings can be set per user in the Add/Edit User control's IP Restrictions tab.
If server-wide and per-user restrictions are both enabled, the server-wide restrictions are applied before any per-user restrictions. Therefore, you should carefully consider how both lists interact. For example, if you set server-wide access to "allow only," and also set a particular user's access to "allow only", then for any host or IP address to successfully connect, it must be provided in both lists. Alternately, if you set server-wide access to "refuse" an IP address, and for a specific user also "allow only" that same IP address, the server-wide restriction will be applied first. This combination will effectively prevent the user from logging in at all from any IP address.