If you have a budget, just skip all the self building and testing and get Deciso hardware. It's great, and some offerings like the DEC 700 line of devices are hard to acquire in the same kind of configuration elsewhere. Since getting one I have no problems anymore or any stability issues or anything. Before I ran OPNsense as VM, but you're always dependant on your Hypervisor Server and might not get the same kind of routing speed and latency as on real hardware thats specially tuned for FreeBSD.For me, the higher price was worth it not to have to spend a lot of time debugging weird edge case issues.
The DEC695 is €649,00 with 8G of memory. The DEC750 is €849,00 with 8G of memory.We run the older DEC650 with 8G of memory and it easily serves a 1Gbit/s fibre connection with PPPoE.I'd go for 8G, too, not because of an abundance of additional firewall services, but because I run ZFS everywhere I have that option.
my 8gig DEC750 handles my symmetrical 1gig fibre connection (FTTH) using PPPoE without any issues...I have Zenarmour running as well