Hi Markus
There are a few reasons for that suggestion…
- It’s never a bad idea, if your network get’s bigger and more complex, to put in a dedicated firewall/box.
- Maybe the bigger reason: I personally need more experience with the NethServer Firewall, if I’m to give the same level of Know-How as you do to help others…
This also has to do with my professional level - most of my clients are clients, a few are friends.
Well: See the box AWR7-PVE-4 (Proxmox with NO guests running…) below? That’s my home Sandbox for testing. I’ve already installed an OPNsense in there, next is a NethServer to be installed, to use as firewall with up to 3 NICs…
All to advance my own Know-How & Experience, so I can advice others here with your level. I am fully aware that this is a NethServer forum, and not an OPNsense… 
I also want Patrick above to have a GOOD experience with NethServer, and not move away to something else after all the errors / missconfigurations he’s had so far.
With NethServer as your firewall and acting AD, if people test out stuff like Wireshark, there’s bound to be problems, as the firewall doesn’t really know how and what rules to set for Wireshark (It’s not part of NethServer so far, but CAN be installed).
OPNsense does have WireShark on board, not Standard, but as an Add-In module. Playing with that separate Box or VM will NOT affect your AD on NethServer, running on LAN (Green). If you’re on a separate LAN / WLan of your Firewall, the problem is there, and not with AD…
I’m not “bitcjhing” about using NethServer’s firewall - I’ve always said NethServer “can” handle the specific issue (And dumped the problem on your desk…), but I couldn’t really help with firewall issues. I want to change that!
My 2 cents
Andy