Your first dedicated security box — a home-lab security gateway at the edge that drops unwanted traffic before it reaches your servers. Switch on intrusion-blocking and flood-absorb as paid add-ons when you need them.
NGFW. WAN + LAN each carry a 1G RJ45 + a 10G SFP+ (11 Gbps/side), ~20 Gbps forwarding ASIC / ~2 Gbps inspected. Cable the 1G RJ45 on each side at the garage tier (matches the edd + switch); step up to the 10G SFP+ as you grow. Inspection (2G) is fed through either side. Stateful firewall base; IPS + Scrub are on-box licenses (capex + monthly). Runs on its own silicon — unlike a gateway add-on it doesn't throttle your router.
