> Is it a good idea to run all sorts of extra stuff on your literal firewall/router?

I don't see any reason not to. I run dozens on services, both bare metal and containerized (Podman) on my router/firewall. It doubles as an all-purpose home server with plenty of headroom to spare. It's just a computer that sits at the edge of my network, and running services meant to be exposed to the Internet on it is natural.

> You also said that Linux has much better performance vs BSD, which seems rather far fetched. Got any data for that?

I should have worded this more carefully. What tends to happen is that BSD has worse (or no) drivers, that's when BSD's performance can noticeably degrade vs. Linux. From memory, people online were reporting issues with Realtek chips. With Intel NICs, the routing performance should be broadly equivalent .

Ah, I see. Well, that does make more sense now. I guess just have a surplus of mini PCs so for me it makes more sense to run one routing box and one server box, but I know how much use cases vary.

I agree about Intel vs Realtek to some extent. My Lenovo M73 OPNsense actually has a 2.5G Realtek mPCIe NIC on the LAN side and it has actually been pretty great and reliable so far! Transmit maxes out early at 2.28Gbps-ish but receive is 2.47Gbps (Jumbo). However, the other week it glitched out and reported UP but was actually unresponsive. I'm still looking for an mPCI Intel i226-V version of the same thing...

The only downside to your solution is that most people (me included) would rather have auto generated configs so that you don't accidentally expose everything to Internet or break everything with an iptables rule, but that's down to experience I'm sure.