OpenWRT is a Linux distro. Just one optimized for embedded devices. If don't like the very utilitarian web UI can connect over ssh and use iptables or whatever else you want.
But that means custom per-device firmware builds, that in my experience with every router I tried it on means they lag months/years behind security patches. Is there some way to stay patched without building from source and reflashing every time a patch to something upstream happens? (almost daily, now, I guess that means?)
If something urgent appears, a point release will be made asap. If worry that isn't soon enough, can use the daily snapshot builds. That said, imo an essential device like a router should be as solid as possible and only upgraded if important rather for minor bug fixes.
That would be great if it were true for a larger range of devices, but they seem to drop older hardware pretty aggressively. My current wifi device hasn't had a new build published since Dec 2025, despite there being dot releases of the same version well past that.