The solution is pfsense

Or openWRT.

The bsd based distributions sure are powerful, but with the power/heat budget to match.

Actually, pfsense kind of has a shitty reputation in the FOSS community and opnSense is preferred.

But I don't like the limitations of BSD systems in terms of hardware compatibility and performance, so I build my router using a plain Linux distro (Debian).

Better go OPNsense

The soulutions is iptables.

The solution is nftables.

The solution is bpf.

The solution is emacs-m-x-butterfly-bpf.