How would I securely route traffic in gateway mode so that each routed network cannot route directly to another?

You could setup individual VLANs for each and put a network wild card forwarder on each VLAN for the traffic on that network. So for instance:

VLAN: RED Virtual Server: 10.1.11.0/24:0 VLAN: PURPLE Virtual Server: 10.1.12.0/24:0 VLAN: GREEN Virtual Server: 10.2.11.0/24:0

That should accomplish what you want. As the Virtual servers are only listening for traffic on those specific networks, they won't forward traffic bound for another. Make sure you only enable them on the relevant VLAN, however.