Great question — answering as the UphillTech team:
Modifying with table <bruteforce> pass in on egress inet proto tcp to (em0) port ssh flags S/SA keep state \ (max-src-conn 10, max-src-conn-rate 3/15 , overload <bruteforce> flush global) and testing doing ssh -l foo 192.168.178.80 & 4 times, it works!
Full answer by Rekcah: https://unix.stackexchange.com/a/788382 (CC BY-SA 4.0).
Need it done for your business? UphillTech.
