What firmware is your BGW320 currently on? There's a method for newish firmwares that should work on the 320, and are confirmed working for the BGW210.
No easily accessible guide for it yet, but for OPNSense and PFSense themselves, there's a simpler bypass available now. It still requires certificates. PFSense has an auth bridge mode that does not require certificates, but requires 3 interfaces and for your modem to still be plugged in.
You will need to connect the ONT ethernet directly to the WAN port for a bypass to work.
No problem! Let me know how it goes.