zeroip is a kernel-module which can act as a dhp-relay, proxy-arp and ipset banned. ipset can banned a lot of ip and process packets stateless and works in layer3. dhcp-relay works in layer3 and receive dhcp packets and relay them to the dhcp server. proxy-arp reply to arp requests and process packets in laey2. This kernel-module developed under freebsd11.4 and for other versions should be tested and maybe needs to changes.