Really the right way to do things is the opposite of how you are approaching, if security is a paramount concern. You'd want to run the router/firewall on the bare metal, and host a VM within that for standard desktop or server usage.
Forgive my crappy MS Paint illustration.
If you bridge the VM's NIC and the LAN NIC (from the bare metal OS), they can appear as the same "LAN" interface for the purposes of firewalling or routing.
Most of the security issues would be if someone were to go up to the console while this is running and disable your router/firewall VM or disable bridging/unbind your NIC from the VM - or if someone were to remote into the system and do that. There's a possibility, as always, that malicious software could do something wacky.
You could do this, and use any VM software if you wanted, but the disadvantage is if you use something like ESX, you'll need to RDP into the desktop VM instead of directly accessing via console.