Some people are having more success using a deny rule, rather than reject. This doesn't make sense to me, as there is a timeout wait element for deny rules, but give it a shot.