[CentOS] which firewall to automatically block bandwidth abusers?

>
> I have read through that document link on
> http://lartc.org/lartc.html#AEN1393 and the closest I could get is
> rate limiting, but that doesn't actually block the IP if it goes over
> a certain threshold, it just slows everything down.

So I'm not sure I fully understand your requirements.  Why isn't slowing 
the user to zero or at least near zero sufficient?