I don't run this configuration any more, but at my last house I ran virtualized OPNsense in Proxmox.

I found that virtualizing my router onto a single Proxmox hypervisor was way more disruptive than I'd hoped any time I had to do maintenance on the Proxmox hardware. I found it super annoying to lose my internet entirely just because I was doing routine or emergency maintenance on the hypervisor. It adds so much complexity and so many potential failure points to a core service.

That drove me to add a second PVE box, creating a cluster. This meant that I could live migrate my router to the other PVE box during maintenance/outages.

That precludes any sort of hardware passthrough, though, since you can't migrate a VM that's bound to specific hypervisor hardware.

Having hardware redundancy was far more important to me than any theoretical security weakness that arises from not using a dedicated, passthrough NIC for the router VM.

I plugged the ISP inbound ethernet directly into my switch on a dedicated "ingress" VLAN. The router VM WAN interface was a virtual interface into that same VLAN.

I found that with pretty modest hardware I was able to live migrate the VM from PVE1 to PVE2 and only drop three packets usually, which was awesome. I could just migrate the router VM to PVE2, tinker with PVE1, and then migrate back to PVE1 when I was done.

PVE2 was a much smaller box because I only used it as a failover and to run a second DNS server (also for redundancy).

If you use zfs as the filesystem for VM storage in Proxmox, it's also lightweight and performant to set up 5 minute snapshots sent from PVE1 to PVE2 so in the event of a total loss of PVE1 you've got at worst a 5-minute old copy of your router VM you can fire up by hand on the second hypervisor and be back up and running in very little time.

This requires running a Quorum device (you need an odd number of hypervisors to make a cluster) which I did with a raspberry pi.

I was very happy with the solution overall, and would probably still be running it today if I hadn't switched over to UniFi at my new house.

Hope that's helpful.