What @DigitalBytes said about sums it up. @RotaryWombat
If you are running an entire virtual system and put your firewall as a VM, and your VM host has a problem, you chance losing connectivity to your firewall, and everything else. Also, even if you do hardware pass through for your network devices that the Firewall will be using. It’s still sitting on top of the Hypervisor, and the host machine is physically outside your firewall, and if there is some exploit that is discovered later on… you get the idea.
If you want to poke around inside the PFsense OS and see what it’s capable of, by all means load it up into a VM.
I would argue to not use it is a production environment.
The main reason I say to use a physical piece of hardware is, as DigitalBytes said, decreases attack vectors, and segments your firewall away from your other hardware/servers and such.
While PFsense is based on FreeBSD, and FreeBSD is a computer operating system. When you are using as PFSense, it’s best to think of it as a Networking appliance and not a “computer.”
PFSense’s base functions as both a firewall and a router. Both are designed to segment and protect your networks.