#####  To Remove A IP From PF ##################
pfctl -t bruteforce -T delete yourip

SSH Brute Force Attack Auto Deny with PF

1.Modify /etc/rc.conf and add these lines. This will enable PF to start 
up when the server does and loads the rules file.

vi /etc/rc.conf

Insert these lines:

#enable PF
pf_enable="YES"
pflog_enable="YES"
pf_rules="/etc/pf.conf"


vi /etc/pf.conf

Insert these lines:

ext_if = "em0"

#SSH Deny Block. 15 max connection, 5 connection attemptes every 30 seconds. 
table <bruteforce> persist
block quick from <bruteforce>
pass in on $ext_if inet proto tcp from any to $ext_if port 22 \
        flags S/SA keep state \
        (max-src-conn 15, max-src-conn-rate 5/30, \
        overload <bruteforce> flush global)


3. Install expiretables

cd /usr/ports/security/expiretables && make install clean

4. Edit the crontab to flush ssh deny table

vi /etc/crontab

Insert this line:

#Clear SSH Deny Table
1   3   *   *   *   /usr/local/sbin/expiretable -t 3600 bruteforce


5. Manually view table entries:

pfctl -t bruteforce -T show
pfctl -s all
pfctl -vs rules

To manually clear table :

/usr/local/sbin/expiretable -t 3600 bruteforce