pass log quick on $ext_if proto tcp from any to any port ssh flags S/SA \ keep state queue (ssh_bulk, ssh_interactive)
becomes
pass log quick on $ext_if proto tcp from any to any port ssh flags S/SA \ keep state (max-src-conn 15, max-src-conn-rate 5/3, \ overload <bruteforce> flush global) \ queue (ssh_bulk, ssh_interactive)
where
queue smallpipe bandwidth 1% cbq
and
pass inet proto tcp from <bruteforce> to any \ port $tcp_services queue smallpipe