I have to say, I think womble's advice is excellent. Normally, one learns before accepting responsibility for production resources, and if you haven't, then get ready to pay for professional assistance when you run into trouble. Learning on the job is a good and normal part of sysadmin life, but not starting from scratch. Most people here are happy to help someone who, having come thus far, needs to learn that next step that they can't quite grasp, but are less keen to spend their valuable time spoon-feeding people who seem incapable of learning (or unwilling to learn) on their own.
That said, what you want to do isn't necessarily stupid. I wouldn't do it by dynamically modifying the firewall ruleset, since the chance of DOSsing yourself is high. I probably would look into the
connlimit module of iptables, which allows you to match on the number of parallel connections for each client IP address. Perhaps something like
iptables -I INPUT 1 -m connlimit --connlimit-above 99 -p tcp --dport 80 -j REJECT
would do what you want. You will definitely want to be aware that order in
iptables rules matters (first-dispositive-match-wins), and that restarting apache after changing the iptables ruleset is almost completely pointless.