Поможет нижеследующий скрипт: 

cd /usr/ports/security/sshguard
make install clean WITH_PF=yes

echo "auth.info;authpriv.info |exec /usr/local/sbin/sshguard" >> /etc/syslog.conf

internet="vlan50"
table persist
block in quick on $internet from label "ssh bruteforce"

pfctl -f /etc/pf.conf
/etc/rc.d/syslogd restart

shguard[1048576]: Started successfully [(a,p,s)=(4, 420, 1200)], now ready to scan.

sshd[1048577]: Invalid user administrador from 211.138.241.51
sshd[1048579]: Invalid user publica from 211.138.241.51
sshd[1048580]: Invalid user rbecerril from 211.138.241.51
sshd[1048581]: Invalid user rvences from 211.138.241.51

sshguard[1048582]: Blocking 211.138.241.51: 4 failures over 15 seconds.
sshguard[1048583]: Releasing 211.138.241.51 after 490 seconds.

Источник: brj http://community.livejournal.com/ru_root/1089461.html