You don’t need a protectli, even an old optiplex should be able to handle opnsense and/or a pi hole. You would just want to have 2+ NICS.