Automating pfctl to block incoming connections and IPs
You can simply replace:

table &lt;attackers&gt; persist
block log quick from &lt;attackers&gt;
pass in quick proto tcp from any port ssh flags S/SA keep state (max-src-conn 3, max-src-conn-rate 5/60, overload &lt;attackers&gt; flush global)


with:

table &lt;attackers&gt; persist
block log quick from &lt;attackers&gt;
pass in quick proto tcp from any flags S/SA keep state (max-src-conn 3, max-src-conn-rate 5/60,  overload &lt;attackers&gt; flush global)


If you want to restrict this to single ports use: ... port {22, 443, 5900:5902} ... instead of ... port ssh ....