Yeah, I would try m0n0wall, but it seems to have a ridiculously over-involved installation process.

Cogent gives the range you request, and 2 of them are obviously reserved for network and broadcast, and then I pick one to serve as the gateway for that subnet.

I think I have Untangle working like it needs to. Thanks for all your help.