This has been the modus operandi of many unix sysadmins for custom router/firewall setups. I did my first setup like this in 1999(?) for a museum office's route

This has been the modus operandi of many unix sysadmins for custom router/firewall setups. I did my first setup like this in 1999(?) for a museum office's router/firewall based on FreeBSD: * standard install, strip down kernel to bare minimum, configure everything * mount everything read only (/var memory backed) * set kern.securelevel to 3 (to disallow raw writes to disks, modifications to the firewall or un-/loading of kernel modules) * ignore the on-site admin when he begs for ssh access (because you of course disabled sshd) The system was first rebooted in, IIRC, 2004 when I had to change the ppp-config after they changed providers. Overall costs: about $100 for old hardware and about 1h of my time.