Well, iptables are there to do first routing: traffic on specific ports stays on host (PVE; custom ssh port, 8006, 123, 53), the rest (tcp and udp) is routed to pfsense (well, onto vmbr1) where I'll do NAT or port forward or whatever.
For example, I also control icmp packages with iptables...