I've emailed a couple of FreeBSD devs and I'm likely to change the put in a merge request for ipfw action to a) the use of tables with ipfw and b) using the lowest free table number to get the rule number.

The start rule will be something like:
<pre>
ipfw add <rulenum> unreach port tcp from table\(<tablenum>\) to me <port> in
</pre>

The rest will be similar to their rule:
http://svnweb.freebsd.org/ports/head/security/py-fail2ban/files/patch-bsd-ipfw.conf?view=log

I've got Christoph's permission to merge this.

Sound better?