table <ssh-ban> persist
block in quick proto tcp from <ssh-ban> to any
pass in on egress proto tcp to any port ssh flags S/SA keep state \
(max-src-conn 5, max-src-conn-rate 5/5, overload <ssh-ban> flush global)
Expiry cronjob (24h):
pfctl -t ssh-ban -T expire 86400