Thanks, everyone. I found two more possible hardware combos in addition to your suggestions, so I guess I have some choices.
If anyone's interested, first there's this mini ITX Jetway NF9Q-Q87 motherboard:http://www.jetway.com.tw/jw/ipcboard_vi ... e=NF9Q-Q87
It can be expanded using this daughterboard for +4 LAN ports (6 total):http://www.jetway.com.tw/jw/ipcboard_vi ... ADE4INLANG
But the overall price is surprisingly high, and the CPU choice is limited (mobile CPUs seem kinda hard to buy separately?)
Second is buying an ASUS Q87T motherboard and expanding it via mini PCIe:http://www.logicsupply.eu/expansion-cards/admpeidla/
Gives you total 4 LAN ports. Many CPU choices, can go Celeron or Pentium for saving money, or even an i3 4130T.
Could save money by choosing a cheaper thin ITX motherboard, but they only have 1 built-in LAN ports instead of 2.
As for the case, been looking at H1.S from HDPLEX. The only small one I've seen which actually has an expansion slot.
Anyway, sorry if this wasn't strictly on topic (prebuilt, barebone, etc.) For prebuilt, I've found this:http://www.logicsupply.eu/systems/firewall/fw200f/
This is exactly the kind of box I want, but the price is rather high (build around the aforementioned Jetway NF9Q-Q8 motherboard). Will see if I can make my own for cheaper.