

In my own experience, certain things should always be on their own dedicated machines.
My primary router/firewall is on bare metal for this very reason.
I do not want to worry about my home network being completely unusable by the rest of my family because I decided to tweak something on the server.
I could quite easily run OpnSense in a VM, and I do that, too. I run proxmox, and have OpnSense installed and configured to at least provide connectivity for most devices. (Long story short: I have several subnets in my home network, but my VM OpnSense setup does not, as I only had one extra interface on that equipment, so only devices on the primary network would work)
And tbh, that only exists because I did have a router die, and installed OpnSense into my proxmox server temporarily while awaiting new-to-me equipment.
I didn’t see a point in removing it. So it’s there, just not automatically started.
The Linux kernel isn’t really much different between any distribution of Linux.
If it works on one, it works on the rest, in like 99% of cases.
The only real exception to that is custom distributions built specifically for a particular device or subset of devices.
In other words, for embedded devices, like phones, routers, TVs and such.
And those aren’t going to be running Ubuntu.