Keep in mind that the default behavior of pfSense is to block all ports on the WAN side of the router. As a result, any remote users who try to connect to a port on a local host will be blocked from doing so. If we want remote users to be able to connect to local hosts, we must add both a port forwarding rule forwarding the traffic to the local host, and a firewall rule, permitting such traffic on the WAN interface. In practice, pfSense has the option to autogenerate a firewall rule from a NAT rule, thus saving us the trouble of having to remember to separately create a firewall rule.