So, a couple of random people are trying standard passwords. That should be a complete non-issue, if your system is correctly configured. Now you want to stop the users and your response is to block "their" IP completely. Which turned the non-issue into self-made denial of service "attack". As those ips are not bound to users and "they" will potentially come from the whole ip space script-kiddies can come from.