A virtualised OPNsense firewall on your Proxmox host gets you what appliance vendors charge four figures for: a full-featured firewall/router guarding your VMs, with snapshots before every upgrade and no extra hardware. The catch is that the setup details (bridges, VirtIO, offloading) decide whether it's rock-solid or mysteriously flaky. This guide covers the network designs that work on a dedicated server, the exact VM configuration the community has converged on, the install, and the honest caveats about performance and protecting the Proxmox host itself.