sshguard

Add the following lines to /etc/pf.conf to block entries in the sshguard
table (replace $ext_if with your WAN interface):

  table <sshguard> persist
  block in quick on $ext_if proto tcp from <sshguard> to any port 22 label "ssh bruteforce"

Then run sudo pfctl -f /etc/pf.conf to reload the rules.