If you've got a static file system on CD, why not a small IPfilter
firewall for a home LAN? That's assuming you can assign multiple IPs 
to the ethernet interface like normal BSD dists. You'd want to come up
with some kind of tool that configs it before burning it to disc -- this
would be similar to the floppy based firewalls like floppyfw, LRP, or
Coyote Linux. A firewall with a RAM disc or immutable filesystem is ideal.
The drawback would be that you'd need to reburn it anytime you wanted to
make changes but with media coming in at .50 each these days they're
cheaper than floppies.

-Gary