I think OPNsense (an offshoot of pfsense) has this capability built in.