opnsense is where it's at. Alot of pfsense users have been migrating off pfsense lately because of all the Netgate shenanigans.
Pfsense had some pretty gnarly cobbled together php/html pages last time I used it (probably 6 years ago now)
Build a vm and install opnsense. Build a base config. If using vlans or multiple interfaces note the order your create them.
Backup config.
Install opnsense on your router. Install backup config. Recreate-adding interfaces in order created.
And nuts web interface for usb-hids it borked. But it works via ssh.
Suricata is a little different. You can get et pro for free with a telemetry agreement. If using vlans only use the physical interface for listening and set the cidr nets in home networks under advanced.