I switched to OPNsense last week. Consumer grade WiFi AP is behind it. I’m not depending on firmware updates from a company that has no incentive to make them.

I blocked packets arriving externally on my firewall with ip-options a couple of days ago. Firewall rule has zero hits, and I've got a very open ISP (andrews+arnold), if I want I can host SMTP, DNS, whatever