OpnSense is the way to go. It has a good web UI. It's robust, featureful, and has wide and growing deployment.
Pfsense is mired in controversy, they attacked their peers, and the owners are not honest. The open source Opnsense project had to appeal to the WIPO to force Pfsense to give them their named domain after Pfsense squatted on it and posted inflammatory messages. They aren't great stewards.
Whenever people ask for router OS (VM or physical) I'd always recommend OpenWrt. Come with WebUI by default (unlike Vyos) and you can do advanced CLI configuration with familiar Linux utils (unlike *sense), and for most users you really just want to do some VLAN so it is perfectly suitable. A bonus is that you could use the same UI for your router and AP, so even easier
Generally you will know when your demand is beyond OpenWrt's capability (usually when you can't find the required package in opkg), and by then you probably know the answer to this question better.
I second this. Openwrt is so fast, I can route 10gbit with half the resources of opnsense/pfsense. It has a nice GUI and has all the features I need.
Do you know if OpnSense allows you to have the same UI for the router and AP? I’m leaning towards either OpenWrt or OpnSense but still looking into the pros/cons between the two.
What this person means by "using the same UI for your router and AP" is that by installing OpenWRT on both your virtualized wired router and your Wi-fi access points, you don't have to learn two different web UIs to configure networking. If you have an existing wireless setup that you don't really want to screw with that doesn't have OpenWRT already, then that doesn't really apply.
I’ve had good luck with PFSense in my environment. Took some learning but it works really well. I am thinking of switching to OpnSense myself.
OPNSense. No issues.
OPNsense, vyos, pfSense, TNSR. TNSR is extremely fast at routing, with some stringent hardware requirements. vyos is Linux-based and very fast at routing virtualized in KVM. The *senses are FreeBSD-based and have their quirks, but if all of your routing is ~Gbit symmetrical, you should be fine.
i like vyos a lot
Really depends on whether you're more comfortable with a WebUI or Command line.
pfSense CE is still perfectly fine, and a lot of features that are behind the paywall are more for commercial users, less for homelabs/home users.
If you are still worried, then Opnsense is a pfSense alternative that's built from the same base as pfSense as it was forked from pfSense a few years ago.
Also, you won't be able to run Proxmox on the Pi. There is Pimox, but I don't know how that would behave if it was in a cluster with Proxmox.