I'm about to order one of these:
http://www.banana-pi.org/r1.html
But I gave up on the firewall idea after googling a bit about the R1,
which is a bit strange. AFAIK all the Ethernet ports are combined into a
BCM53125 switch thingy + a real ethernet which is connected to the
switch. Hence, while it is possible to split these up via VLANs they are
electrically a single bridged infrastructure. So, eg. if the box crashes
but power is still on then your outside will effectively be bridged to
your inside, which I consider a bit pessimal for a firewall.