@spirit - To clarify, when you ay you need a bridge in VM - this only applies when you're using ntopng Edge inside a VM, to filter for other VMs, right?
As in, you don't need this bridge if you are simply passing through the NIC direct to the VM, right?
The nfqueue and Proxmox firewall sounds...