The thing is that a firewall will require at least two network interfaces - one that connects to the outside and one for each of the internal networks you want to connect. I can't think of anyway to put two NICs in any compact...
I say get a Mac IIci or similar, and two
supported NuBus NICs, and put OpenBSD on it and use pf. I don't think you'll get a more secure system than an OpenBSD system with every thing but pf and whichever proxies you need turned off, and I can't imagine it being much of a problem for a Mac IIci, strainwise.
In fact, I think that would be a pretty decent semi-retirement for an old Mac
If you want to run a firewall, stay away from Linux. It's not as secure, the documentation isn't as good, and whatever advantages Linux has, such as better hardware support for some platforms and a slightly better audio infrastructure, are a non-issue. The OpenBSD installation will take a bit of work + reading, particularly the disk partitioning, but don't be scared, it's really not too bad once you get to grips with it, and once it's up, it's up.
Generally, I think there's very little reason to run Linux over BSD except for when you want something free for a desktop that's easy to install and somewhat idiot proof (like if you're tired of reinstalling Windows on your parents' computer), in which case Ubuntu is very good.