For MSP-friendly deployments, OPNsense or pfSense are common choices with WireGuard/IPsec overlays. For routing-heavy designs, VyOS is a strong option. For flexible “SD-WAN + apps,” Ubuntu/Debian works well.