2.5GbE Linux Firewall Micro Appliance Celeron N5105 4xIntel I226 Nic Firewall Router PC Barebone No Ram No SSD AES-NI

I don't run OPNsense in a VM myself, I still have it on its own hardware. https://www.amazon.com/dp/B0B81PLW8N Doesn't take much 4GM RAM and a 128GB drive. 8GB RAM if you plan on having some crazy large firewall rules. ISP modem > OPNsense machine (eth0) > (eth1) network switch. Leaves 2 extra ethernet ports for other uses