[Kludge]

Bare Metal: Arch
Host: Depends on what I'm doing: Windows 7 or Debian
Guest: Again, depends: Windows 7, various Debian distros, various Ubuntu strip-downs, mostly minimalist distros with no spyware.
Firewall: UFW on every level of Linux being run, and a highly customized set of rules at the router, leading to another complex set of rules at the modem itself.
Anti-Virus: Don't touch anything that even SEEMS remotely sketchy unless I'm running a Guest specifically to click that link and nothing else. Defender on Windows Guests.
Privacy: Massively long proxy chains ending in Elite/Anonymous SSL SOCKS servers running alongside VPNs stacked at every level; Bare Metal, Host, Guest, VPN Browser Add-on for standard browsing, TOR for fun stuff.
No virtual machine touches anything from any other virtual machine except for the packet tunnels created by the proxy servers and VPN connections. Layers of multi-VPN service stacking cause encrypted data to be encrypted again and sent through a VPN, coming out still encrypted and then through an Anonymous proxy... With enough proxy chaining and two VPN services that are able to stack on top of one another without causing infinite TLS handshake mode, basically no one knows what data is being sent and from where.
But I am also possibly the most paranoid man anyone's ever met when it comes to my browsing habits: It's not that I have anything to hide; It's that I don't have anything I want them to see.