Get 2 devices, set them up the same and put 1 in a cupboard. When you make a change / update and / or the hardware fails, then you can still recover. Personally I have a Fritz router in bridge / pass through mode, then a pfSense firewall - basically a low-ish power microATX (I think) PC - which does all my adblocking and DNS as well as reverse proxy for home assistant, etc. Works well