This is excellent. I can't even say the same thing about my AT&T fiber gateway. It listens on two random ports with no way to turn it off (and also you can't use your gigabit internet without the AT&T gateway in front). I don't know what it is, but I'm sure it's probably insecure.
I implemented it differently, but probably less sensibly. I have a FreeBSD as my NAT box anyway, so I added some network cards, and run a ethernet bridge in front of the gateway (I commented out the lines that dropped traffic to reserved multicast addresses because that include 802.1X), and divert only a small fraction of the incoming packets (ipv6 tunnel from he.net, most udp 123 packets, icmp pings, port 25), that the gateway won't give to the DMZ host (I have the Pace 5268AC gateway which likes to ruin things; the NVG599 one is probably better). You can PM me on DSL Reports with the same username, if you want more details on my crazy setup. :)