Something

table <limituser> persist
block quick from <limituser>
pass in on $ext_if inet proto tcp from user = roob to $ext_if port any \
        flags S/SA keep state (max-src-conn 5, overload <limituser> flush global)