I was also going to suggest pfSense. It'll mean more hardware, but that's a one-time cost--no recurring costs with that. Though I myself am wondering how to best go about keeping the public-facing side of my SME server (web and mail server) public when behind the pfSense firewall. Not sure if it's a simple matter of port forwarding, or if there's more to it.