I use exactly the same thing after I got tired of pfSense: straight OpenBSD, PF, unbound, and a couple of other native obsd things (starting to play with OpenBG

I use exactly the same thing after I got tired of pfSense: straight OpenBSD, PF, unbound, and a couple of other native obsd things (starting to play with OpenBGPD for AS level filtering) on NUC-alikes (currently liking Protectli and Seeed). No pretty web interface, but the documentation is so good it was pretty trivial to set up. This has worked really well for several years now. Note: like vogon said above, it's easy to overcomplicate things like this. If you go this route, start with the most basic configuration that works, and only go looking for 'tuning' or 'optimizing' if you run into a specific issue and can measure before-and-after improvements. Obsd does a very good job of working correctly out of the box, and if you follow the advice of some 'popular' PF tuning sites, you'll end up with tons of stuff you probably don't need, probably will interact in weird ways and will get you laughed at when you go looking for help. KISS. One caveat: Don't expect to go to the obsd mailing lists or IRC channels for beginner support.