You can reuse old Firebox hardware, x550, x750e, etc, if you want gigabit, and flash PFSense onto them. That's what I am going to do.
At the moment I am running PFSense inside of a VM and have a internal virtual adapted allocated to it's LAN so all my VMs are behind it.