I've been using a Fortigate for firewall/router. It has wifi capability. AV, URL Filtering, IPS, SSL Inspection, DLP, Application Control etc some controls require a subscription. You can also setup as a transparent proxy for http https ftp and can be setup to sit in the middle of ssl session so that it can look at the traffic going in both directions. Just because you have ssl going doesn't mean your safe, it could be implemented incorrectly and the far end may have been compromised. So unless your security device can read the encrypted traffic, it won't have any idea what it is and that it may contain code you don't want to get to your computer. Then you might want to use an AV you trust on your endpoints.
Also, like vvanders posted earlier, prudent computing behavior is very important.
A good backup with ability to restore, can be your friend as well.
I've been using malware bytes premium for years. Bitdefender, this year. MVPS hosts File.
A windows vm with Sandboxie running commodo dragon if your going to be going places that are shady. When im done, revert to prior snapshot.