For the n-th time I found Proxmox+OPNSense to get into trouble.
Each time it takes a long time to get to the issue which is essentially 'rewriting' interface names.
Yes, I did not bother to go look for configuration files, yet, there was no indication the config was wrong.
Neither for Proxmox neither for OPNSense the config changed in recent months.
What appears to happen and is observed as a progressive issue is ... first some disruptions, eventually in Proxmox the OPNSense VM shows normal config on the outside but on the inside the interface MAC from the VM is assigned to a different interface or as a secondary MAC (yeah, i know)
I'm now swithching the WAN from virtio to e1000 to see if that makes any difference.
To me this is a mind numbing issue. At one point the OPNSense admin interface was no longer reachable while this is over a dedicated interface with a direct connection over UTP.
The fix was to use a Proxmox feature to rename the interfaces, last time I did something similar manually, this also worked.
Specific to OPNSense I'm worried Proxmox can simply reassign MAC and this doesn't revert, for OPNSense to allow for multiple MAC or a MAC which is not matching the configured vtnetX interface is concerning.
Hoping for your feedback, available to work on analysis if possible.
First, Proxmox changes its scheme to name network interfaces (https://forum.proxmox.com/threads/update-to-8-2-changes-the-names-of-the-network-interface.145739/) once in a while - this is mainly because of Debian / systemd releases changing it.
If you want to have predictable names, you can follow the advice given here:
https://systemd.io/PREDICTABLE_INTERFACE_NAMES/
I always use net.ifnames=0 on the kernel commandline. With a Proxmox server, you rarely get into trouble with that, unless your network devices really change (like with USB adapters or when you switch hardware). Then, I only have to set eth0-X in /etc/network/interfaces. This has no effect on the VMs, because their MACs are assigned in the VM configuration and the device type is determined by the NIC emulation type, which does not change when you do that.
Second: When you use OpnSense as a VM, the virtual NICs are contained in the VM definition - actually, upon creation, a random MAC is being assigned to the interface. These MACs may change when you backup & restore a VM, especially, if you restore a "unique" instance. This is true regardless on which emulation you use for the NICs. It is different with PCIE passthru, since then, the MAC address is the physical adapter's MAC.
Besides: IDK if it is possible to use the "change MAC" feature from within an OpnSense VM - I would not even try that, but leave the control to Proxmox.
Also, FreeBSD sometimes renames drivers for NICs with a new release. That may mess up the interface assigments for the logical interfaces (say if em0 becomes igb0). The assignment will not switch without a new OpnSense release, however.
So, the chain is:
1. physical NIC. This has a name which depends on Proxmox / Debian / systemd versions. Best to fixate it.
2. Mapping of VM virtual NIC to Proxmox bridge interface - this determines what MAC is used and which emulation type of adapter is presented to the VM.
3. "physical" NIC in OpnSense: its name is dependend on the type of emulation and thus, the selected driver. The MAC is determined from outside and should not be changed from within OpnSense.
As for your "secondary" MAC question: As I said, I never tried to change a VM MAC from within. I do not even get in which situation you would have multiple MACs on the same interface (unless it is a bridge, but that does not directly map to a "physical" NIC).