Could you not just deploy it on whatever device you're using as a firewall?