I'm doing the exact same thing, I switched ISPs and found that PFsense would only give me 10% of my WAN bandwidth due to the way the pppoe daemon is threaded.

I'm doing the exact same thing, I switched ISPs and found that PFsense would only give me 10% of my WAN bandwidth due to the way the pppoe daemon is threaded. My new firewall is Debian managed by Ansible, the playbook sets up pppoe, nftables and nettopng. I really missed pfblockerng, so I wrote a shell script to download Firehol feeds and inject them as a set into my nftables rules. Whole thing works great off a Proxmox J3455/8Gb mini PC with 2 NICs, leaving room for some LXC and Docker containers/