I was a bit disappointed with my Dream Machine Pro at the start, but now it's getting there - they now even provide a simple VPN solution that work on top of Wireguard.

What's still missing is more advance routing exposed in the interface (like dnat) and it would be perfect. I have another one deployed in a shop and it's working fine, even with the harsh hardware condition it's put in (lot of dirt/dust from auto mechanics, even if it's protected in a rack high in the room)