Error in my pf syntax

[calanon]

I have added this rule but I keep getting a syntax error:

pass log proto tcp to self port ssh \
        (max-src-conn 8, max-src-conn-rate 15/5, \
               overload <bruteforce> flush global)

[jggimi]

You need a state directive before the state options. Try adding "keep state" after "ssh" on line 1.

[calanon]

Originally Posted by jggimi

You need a state directive before the state options. Try adding "keep state" after "ssh" on line 1.

Perfect it works!

[jggimi]

There's a GRAMMAR section at the end of the pf.conf(5) manual. It's in BNF, so can be difficult to comprehend ... but sometimes I find it can be helpful when I get unexplained syntax errors.