Another Synology fan here - I hadn't realized they had wireless routers - although from the picture, they don't look to be wall mountable(?) Also, can they handle their "WAN" port attached via virtual LAN - or do I need a separate hardware connection to put one in a DMZ?

As far as firewalls go, I've had good luck with pfSense running on a Qotom i3 box. pfSense is free software, comes with a distro of DCD Unix - you provide your own 8086/AMD hardware.

When we built the house, I setup CAT5e (tells you when we built) through the house, so I have the luxury of only using wireless for mobile devices. Mobile devices all use OpenVPN to connect, no matter where they are. pfSense comes with a built-in OpenVPN server and a dynamic DNS updater so nothing extra needed.

It also has SNORT built in. At work, we have a 'pro' subscription (very not free), at home, I'm using the free version which does all I need. And there are lots of add-ins available. I'm using one to 'go dark' for any attempted connections coming from outside the US/Canada.

The downside? The learning curve. But if you can figure out Fortinet, pfSense is a snap.