Perhaps software and virtual routers are the way to go, especially if any are open source. It would be great if someone with knowledge in this domain could comment on this.
Once you have a company designed to create this stuff in an open-source way, virtualized software alone wouldn't change hardware interdiction. If somebody can modify your gear, they can modify the software that runs on your gear. If the hardware was designed to only work with certain signed code, that's another thing... but that would need to be a per-device, per-customer solution, which could get pricey.
For a more practical solution you could use today, I would buy hardware locally, then hide it amongst scrap metal and declare $0 value, and have a trusted courier ship it direct along with a secret receipt. If somebody interdicts, i'd have the courier deliver an erroneous receipt so I know something bad happened.
I do this at home and work with a Debian router.
There is also pfsense as well.
You won't like the price of the board I mentioned. On the other hand, nobody said a dev board with a bazillion extra features you don't want, made in extremely low quantity, is the cheapest possible way to stick a bunch of ethernet PHY to a FPGA (and you could optimize the size of that FPGA if you wanted...)
The point of that provided example multi-ethernet FPGA development board isn't that its the best you could do financially or technologically, but that if you tried to do your own thing and screwed up, its probably difficult to do worse.
As a practical matter having fooled with much smaller and simpler things the price should end up competitive in the end.
The biggest problem is synth takes a long time, god only knows what the CIA and KGB ops embedded in the source, and the IP licenses probably make distribution of the source rather difficult. Its mostly a business/government problem, not a technological problem.