Theres also a plugin for opnsense which is pretty much plug’n’play.
But iz doesnt have access to service access logs so it will be a bit more handicapped.