Not attempting to answer his question, but, on linux a firewall is just a set of iptables commands (and other optional stuff like tc and ipset)

Most people on linux tend to believe that there's some magic to that and allow standard packages to decide those rules, but in general it's quite straight forward to add your own iptables rules to an existing one, or even do your own one from scratch.

While routers do usually let you decide the rules in them also, I'm not one to trust a router to decide the actual rules in an environment I'd want secured, since you need to spend a lot of money on a standard router if you want to have something that's reliable in that area ... e.g. my home configuration is a linux box as a router (12G ram, raid1 SSD, old i5) that talks bridge mode to the internet connection and of course the firewall is scripted by me