Recently, I wrote an article on building a budget small-form-factor pfSense box for less than $200. If you're really on a budget, and don't mind repurposing 100% used hardware, it might be worth while to scrounge around online (or maybe at your workplace, if you're in IT) for a HP T620 Plus thin client. Don't let the name fool you: these are actually fully capable x86 PCs, albeit with a low-power AMD Jaguar embedded CPU - perfect for use as a pfSense box and power-efficient network appliance.
The HP T620 comes in two variants, a standard version and a slightly thicc-er "Plus" version. You'll want the Plus variant as it's capable of accomodating a half-height/low-profile PCI Express x16 expansion card. The T620 Plus is equipped with an AMD GX-420CA; this particular part is actually at the top of AMD's 1st-generation G series of system-on-chips (SoCs) intended for embedded sytems, and packs four Jaguar processor cores clocked at 2.0 GHz along with a Radeon 8400E GCN-based integrated GPU. Importantly, the Jaguar architecture supports AES-NI and will therefore be ready for the future 2.5 version of pfSense. The entire package is rated for a TDP of 25W. Performance-wise, the GX-420CA is roughly equivalent to Intel's Celeron J3455, which is based on the newer Apollo Lake microarchitecture.
The T620 Plus can be readily found on eBay, and prices range from $55-75 USD depending on demand. At the time of this writing a seller named "4tronenterprise" is auctioning ready-to-go units that include 4GB of RAM and a 16GB SSD preinstalled as well as an OEM HP AC adapter.
The T620 Plus only has a single Realtek-powered RJ45 port in its default configuration, so you'll need to add an Ethernet PCIe card for more ports. There are plenty of used examples to be had on eBay for $20 USD or less. IBM, HP, or Sun branded dual/quad-port server cards with Intel chipsets are known to work very well in terms of reliability and performance. Older cards with the Intel PRO/1000 chipset are probably the most common, but you might get lucky and snag something newer (I saw a Sun quad-port I350 card for $19.95 shipped very recently). Just make sure that the card you get has a low-profile/half-height bracket - otherwise, it won't fit!
Installing your newly-acquired Ethernet card is a relatively simply affair, thanks to the T620 Plus's enterprise- and IT-friendly toolless serviceability. I do recommend you refer to the hardware reference guide first, but in a nutshell it involves removing the back panel, sliding off the top cover, and rotating the fan assembly out of the way in order to access the PCIe slot.
Once the hardware is ready, installing pfSense, OPNsense, or your distribution of choice can be easily accomplished with a bootable USB flash drive.
I've only encountered one minor issue so far - due to the recessed nature of the PCIe slot, it's somewhat difficult to unplug Ethernet cables after they've been plugged in. However, for a total price of well less than $100 USD, this is a minor quibble and one that I can't really complain about at all.