pfSense on a ZimaBoard 216 works astonishingly well and it's easy to setup and manage. Toss in a Mikrotik CSS610 and you have a vlan ready setup in under an hour.
If you don't like the ZimaBoard, you can go with any of the Topton style router PCs from AliExpress for a couple hundred and have a 2.5Gb router running in proxmox with docker in a separate VM.