You can route traffic in different ways, for a high traffic endpoint hook an IP straight into nginx, while regular to via virtual opnSense router, that adds overhead but more flexible routing. Got PVE with virtual networking inside.