Someone

ext_if = "fxp0"
services = "{22,25,80,110,465,443,6667,6697,10000}"

table <sshguard> persist

set skip on lo0

scrub in all

antispoof for $ext_if

block in quick on $ext_if from <sshguard> to any label "ssh bruteforce"

block drop all

pass out all keep state

pass proto tcp from any to $ext_if port $services flags S/SA synproxy state