Was always a fan of packet filter. So I think maybe pfsense would be cool if you have hardware that supports bsd drivers.

Or for Linux, I like just installing myself with shorewall, snort, maybe some wireguard etc