Aware of 2 things:
If your current ISP-supplied Gateway box does NAT and can't be turn off, then a hardware firewall will double-NAT, this maybe an issue if you run/will run torrent.
Build one yourself as mentioned with a PC, or an Internet Appliance from SonicWall, Zyxel and others, usd$150+, they do not instantly give you a super friendly, idiot proof interface. These equipment, while better than CLI, do assume you have better knowledge than your street Joe home user.