pfSense VM on Proxmox: PPPoE only works when parent NIC is PCI passthrough — virtual NIC breaks LAN→WAN traffic

[w0w]

I’m running pfSense as a VM on Proxmox. WAN is PPPoE.

If the PPPoE parent interface is a PCI passthrough NIC, everything works.
If I switch the parent to any virtual NIC (VirtIO/e1000) on a Proxmox bridge, pfSense connects via PPPoE and gets an IP, but not all traffic passes. pfSense itself can ping using pppoe0, clients can ping DNS servers, but can't open pages on the internet.

What I verified:

PPPoE session establishes normally on the virtual NIC, ookla speedtest on pfSense itself runs just fine.

NAT rules are ok.
Offloading disabled inside pfSense (Checksum/TSO/LRO)
Separate bridges for WAN and LAN
Proxmox firewall disabled
Multiqueue on/off tested
If_pppoe/mpd tested

Key issue:
Works with pci passthrough and virtually not working.

Looking for ideas: VirtIO/iflib bug? Proxmox bridge issue? Offload problem on the host?
Can anyone replicate issue on the latest version?

[w0w]

I've used the same Proxmox VM template for IPFire and everything works as expected.
I also tried installing 2.8 from scratch, and it works just fine.
Only the latest beta plus fails to pass traffic to clients.