arp(8) has the following properties of specifying arp entries:
-s hostname ether_addr Create an ARP entry for the host called hostname with the Ethernet address ether_addr. The Ethernet address is given as ... If the reject keyword is specified the entry will be marked so that traffic to the host will be discarded and the sender will be notified the host is unreachable. The blackhole keyword is similar in that traffic is discarded but the sender is not notified. These can be used to block external traffic to a host without using a firewall.
Bring back the support of this behaviour in the kernel.