Correct way to stub devices in syslinux.cfg?

[Dav3]

What's the correct way to stub devices in the syslinux file?  I'm getting strange results depending on where the vfio-pci.ids= parameter is located on the append line.  My goal is to get pfSense running in a VM to firewall other VMs.  Following Spaceinvader One's youtube guide, I purchased & installed a PCIe 1x NIC to pass-through to pfSense.  I'm stuck on the NIC passthrough step.

 

When I stub the device using "append initrd=/bzroot vfio-pci.ids=10ec:8168", the device is able to be bound to the VM.  However I also still see the device (both the motherboard NIC and the new PCI NIC actually) in settings/network.  They're listed as eth0 and eth1 as if the PCI NIC wasn't stubbed.

 

When I stub the device using "append vfio-pci.ids=10ec:8168 initrd=/bzroot" (note the order is swapped), the device is also able to bind to the VM, but now the PCI NIC device is now no longer listed in settings/network. (??)  Also, in this boot configuration unraid also can't see the WAN, which is really strange.  I can access the web interface from another machine on the LAN, but when I ping a WAN address (1.1.1.1), I get a 'network is unreachable' error.

 

So the questions boil down to, 1: what's the correct way to stub the device (order seems to matter for example) and 2; why can't the remaining NIC see the WAN when the other NIC is stubbed out?

 

Thanks in advance for any help.  Apologies in advance if this is a noob issue.