I was going to say ipfire, which is particularly interesting to me because of grsec built in, which is awesome.

That being said, if you haven't already, it's time to start learning NFTables and skip right to the chase.

Personally, I tend to not like abstracting firewalls away via guis or other methods like firewalld. It's more work sure, but I understand whats going on and have better control.