table <abuse_ssh> persist file "/etc/pf-abuse_ssh"

block in log quick on $if_inet proto tcp from <abuse_ssh>

pass in quick on $if_inet proto tcp to any port 22 flags S/SA synproxy state \
	(max-src-conn-rate 4/60, overload <abuse_ssh> flush)