Flexibility indeed. My first router was Linux/ipfwadm, and after many years of trying various off the shelf devices I finally came back to straight GNU/Linux. D

Flexibility indeed. My first router was Linux/ipfwadm, and after many years of trying various off the shelf devices I finally came back to straight GNU/Linux. Debian for the longest time, now NixOS, as a virtual machine on a larger host. I use nftables directly, with a template engine - the same config generates rules for two premises routers and a bunch of cloud hosts (with a fully-connected mesh of wireguard links between each pair of routers, of course) The rules make extensive use of policy routing, such that every device on my network has its own view of what services it is allowed to access, and what Internet horizon it sees. Loading the rules fails safe in that forwarding is only enabled after a successful (re)load, and the rules fail safe such that if a connection doesn't have a valid fwmark then it's not allowed to go out any interface. This allows me to do things like have two web browsing VMs that display side by side, one coming from my physical infrastructure IP and one coming from a often-rotated data center IP. The system has served me well, but is obviously quite bespoke. I'd love to factor it out some day and publish it for general consumption, but I haven't quite figured out how to retain the flexibility while making it have broad appeal.