Is this network setup possible/valid?

Question

I previously asked this question on network engineering but my question was put on hold there and I was advised to try it on superuser, so here I am.

I am planning a little network for a business visualized in the following figure:

To provide some more information, the IP 1.2.3.4/29 is a static external address given by our ISP. A FRITZ!Box and an OPNsense route into/through their 172.16.0.0/16 network. The OPNsense has another 192.168.0.0/24 network on its LAN interface. In this network a manageable switch and a server hosting VMs reside. The VMs are provided with IP adresses via the hypervisor of the server (Proxmox VE).

My question is simple, do you think this setup is valid? Btw. the goal of this is to be able to reach the VMs from the Internet via a remote desktop solution.

Thank you for your valuable comments/answers.

Kind regards, David

UPDATE: I changed the picture and description to better fit a correct solution and your contributions.

Answer 1

1) Each connection (a line in your picture) is for connecting 2 devices with different IP addresses from the same subnet.

2) Each device owning 2 or more interfaces (all except VMs) has a separate IP address for each interface from a different subnet unique for the whole scheme.

So your scheme may looks like (as I understand your server have 4 separate NICs - one WAN and 3 attached to VMs by separate patch-cords):

                   Internet
                       |
                   1.2.3.4
                    Router
                 172.16.0.1/24
                       |
                 172.16.0.2/24
                   firewall
                 192.168.255.1/24
                       |
                    switch (192.168.255.3/24)
                       |
                 192.168.255.2/24
                     WAN NIC
                     Server
     NIC1              NIC2              NIC3
192.168.1.1/24    192.168.2.1/24    192.168.3.1/24
      |                 |                 |
192.168.1.2/24    192.168.2.2/24    192.168.3.2/24
     VM1               VM2               VM3

A switch has no own IP address in routing scheme. Its IP is only used for management.

Additionally: router and firewall should have the routes to 192.168.0.0/22 via 172.16.0.2 and 192.168.255.2 respectively.

Update: If your modem is a simple interface converter, and not a router, it will have no address, and 1.2.3.4 will be the address of the firewall's WAN interface. In that case the firewall must operate as a NAT-router, not as a simple router.