- Debian is a dependency hell, otherwise fine.
I agree on the older packages (I don’t need cutting edge), but what do mean about “dependency hell”?
Side note, I laughed a bit at this, I haven’t heard the term “dependency hell” since the old rpm editor hat days before yum.



Then you will have to do it with bridging.
Create a second bridge and bind only the wan interface and the physical interface of opnsense to it. Then create a 2nd interface for opnsense, but bind it to the brIdge libvirt uses to connect its guests.