In iptables there is a nice module called hashlimit.
Being in love with OpenBSD and PF, I decided to find if this wonderful firewall has the same feature.
As a minimal example, you can use this rule to allow =< 2 SSH connections per 60 seconds:
pass in on $ext_if proto tcp from any to any port 22 keep state (max-src-conn-rate 2/60)
Note that you have to use parentheses, even using just one option (max-src-conn-rate), otherwise you’ll get an error while parsing the ruleset.
Keep in mind that one of keep state, modulate state, or synproxy state must be specified explicitly to apply this option to a rule.
For more information read the documentation for pf.conf syntax.
