Fsil2ban piped to pfblocker works great. Plus snort

Yep it is slow but steady.

It works great as long as you have a method to access the server directly when the router machine is down. A laptop set to a static IP on the same subnet will let you access the host when you b0rk something. Keep a backup config on that machine It’s pretty great though. Just remember pfsense won’t support more than 7 external interfaces when you start getting crazy with vlans