I've got some PC-based firewalls like the Protecli. Mini-ITX, atom-based, 8gb ram. I can often find these for <$50 on auction sites. If it's one I'll be the main "owner" of, I like to run VyOS for firewall and routing. This is the open-source fork of Vyatta, and Ubiquiti's EdgeOS is a commercial sibling (granted, EdgeOS has or at least had some advantages over IPv6 PD). VyOS is debian arm based, so lots of packages like ZeroTier VPN can be added easily. I like VyOS/EdgeOS because of the full CLI/scriptable config.
I recently setup 3 of these for a radio club. These will live in mountaintop tower locations and provide VPN+NAT. Since these might get modified by others, I went with OPNSense. OPNSense is a fork of PFSense with a nice Web UI and community support.
not to quibble too much but I think the bulk of vyos development takes place on x86-64 and the standard build-your-own-install ISO guide is for x86-64. Though it certainly can be compiled for various types of arm CPU.
this is because if you want things like eight or ten 10GbE interfaces, or eight 10GbE and four 100GbE in one server, the only economically viable and fully stable platform for vyos right now is x86-64.
I love that it runs vanilla Linux/BSDs and is a complete white box. I'm able to configure it exactly the way I want it, and I can even run non-trivial services on it. These days I mostly just port forward as I like to keep things as separate as possible so that when one thing goes down I don't lose everything, but it's great to have options.
Especially while I've got two ISPs, the ability to bond and use both at the same time is super neat.
These have not been prettied up for public consumption, but this is how I have it configured if you're interested: https://gist.github.com/FreedomBen/f8a50c7a98c07171a99c419a5...