Haven’t seen any satisfactory answers here. I am running my home pfSense box with just an OpenVPN server on an ASRock J3455M with a HP Quad Intel Gigabit NIC. You could find the same board in different variants, like mini-ITX. The CPU, the Celeron J3455M is a quad-core atom part, similar to the J3160, but with double the cores and the slightly older architecture (which isn’t at all huge difference in performance). It also support AES-NI. Total cost should probably be under $200 (the RAM and maybe PSU would be the most expensive).
I also don’t suggest you virtualise, get physical hardware. I am not sure how many connections you intend to have behind the appliance, so it depends, but given the small CPU utilization and the fact that it is a quad-core, I think the J3455 could deal with some deep packet inspection and VPN and probably some more stuff before it even gets close to being a bottleneck.