But, to what? I like to have a web ui and collectd metrics out of it. And the performance should be good for over twenty devices, VPN and a gigabit network...
pfSense: an established product. Supports kernel level wireguard and easy adblock through plugins. Easy upgrades. Not that great web UI but does its job. Shady OSS practices.
opnSense: no kernel level wireguard yet, but might be coming soon. No good adblocker plugin available. Easy upgrades. Great UI. Better OSS practices at least for now.
OpenWRT: supports kernel level wireguard. Supports LXD so you can install pihole. Good UI. More focused for market routers, meaning an x86 installation and upgrades mean flashing and reinstalling all extra packages.
Edit: seems like recent versions if opnSense handle DNS level adblocking quite well. I might give it a try tonight.
https://www.cjross.net/dns-security-and-adblock-with-opnsens...
I was so impressed with it I tried to rationalize just keeping Ipfire duties but transferring it to a much less power hungry device but couldn't find anything that was modern and wasn't a hobbyist kit (like the Apu2). Other than their own licensed devices that were out of their budget (smallest one is $390 and still needs a separate wifi AP).