Configure PF Firewall on OpenBSD 7.5

/etc/pf.conf

ext_if = "em0"
set block-policy return
set loginterface egress
set skip on lo0
block log all
pass in quick on egress proto tcp to port ssh \
    flags S/SA keep state (max-src-conn 15, max-src-conn-rate 5/3, overload <bruteforce> flush global)
pass in on egress proto tcp to port { 80 443 }
pass in on egress proto icmp
pass out all keep state

Apply

pfctl -f /etc/pf.conf

Useful commands

pfctl -s all         # show all rules
pfctl -s state       # state table
pfctl -t bruteforce -T show