OpenWRT is a Linux distro. Just one optimized for embedded devices. If don't like the very utilitarian web UI can connect over ssh and use iptables or whatever else you want.

But that means custom per-device firmware builds, that in my experience with every router I tried it on means they lag months/years behind security patches. Is there some way to stay patched without building from source and reflashing every time a patch to something upstream happens? (almost daily, now, I guess that means?)