Open Source Firewalls: OpenWRT
In the early 2000s, Linksys released the WRT54G broadband router/firewall/switch/wireless access point—with five wired Ethernet ports, Wi-Fi, and management software. It was (and is) perfect for small networks.
Although the original firmware was limited, it was Linux-based so eager hackers downloaded the source code and improved it. This spawned excellent third-party firmware replacements, such as Sveasoft, FreeWRT, DD-WRT, Tomato, and OpenWRT and turned a useful $70 router into a $500 routing powerhouse.
Now you can choose from dozens of these great little routers. Update the firmware, and use them as your sole firewall and router for small networks, as secure wireless access points, or to set up wireless hotspots.
Today, you can flash new firmware using your router's Web interface in about five minutes—an easier, safer process than it used to be. The primary risk is a power interruption. If you can keep the lights on long enough to flash the new firmware, you're set. Plus, a number of router vendors install DD-WRT or OpenWRT rather than maintain their own firmware—no updating software required.
Before you buy, visit the OpenWRT website and consult the Supported Devices database. It's easier when you buy a well-supported product. OpenWRT is free of cost, with no commercial support options.