Comment by mben

Check pf-diverters [1]. We are using them in our openbsd firewalls in order to block unwanted connections.

[1] https://github.com/echothrust/pf-diverters