The quick escape

Last matching rule wins, but quick stops all processing

     pass quick inet proto tcp to 192.168.193.12 port ssh
     block inet proto tcp to port ssh