pfSense does most of its routing transparently. For example, if we have two local networks, LAN and DMZ, the firewall rules allow traffic between the networks. If a node on LAN tries to establish a session with a node on DMZ, pfSense will send packets to the right network, assuming that the network is directly connected to pfSense. If a node on LAN is trying to establish a session with a remote node, then packets that have the remote node as their destination will be sent to a gateway. There are some special cases, however, where this form of transparent routing isn't enough, and we will discuss them in this section.