[aborsy]

For firewall, I suggest an OPNSense box. You could run it on a thin client, a Protectli etc.

For AP, OpenWRT seems decent.