Thanks, Shonky. That's the sort of thing I'm looking for. I already have the box with Intel NICs (purchased from Protectli), it's just a question of what to put on it... and I think you've tipped me over the edge to opnSense. Looking at the CVEs, it doesn't seem like there are any more than pfSense, so... *shrug*.