pfSense running on an old laptop or other lightweight system, along with a VLAN-capable switch and a Ubiquiti or Cisco WAP371 wifi point. Bridge pfSense to your modem, and you have a full stack. You can run your pfSense box on a stick via VLAN-ing, so you only need one interface.
Just be aware that if you're using any flavor of Comcast in the US (Business or Consumer-class), "Bridging" your cable modem will make it cease to work and require a factory reset. Anecdata from me, from sites in Boston, Seattle, and Portland.
Personally I prefer at least desktop hardware for my pfSense boxes, with a physically separate WAN and LAN port. Maybe that's just because I'm bad at VLANs.