Handling ssh login attempts with pf

[mayuka]

Hello.

Since a couple of days my little router appearances a lot of connections to port 22 from a bunch of same hosts which my pf firewall correctly drops. How can I put those attemps automatically to a table "attackers"?

I had something like the following in mind. Is that possible?

table <attackers> persist

block in quick on $EXT from <attackers>

block in quick on $EXT from any to ($EXT:0) port 22 (max 1, overload <attackers> flush)

Obvious. The third rule does not work. But how can I accomplish something like that?