The process is roughly as below:
1. Client powers on
2. NIC initiates PXE process
3. NIC acquires DHCP address
4. NIC contacts PXE server (WDS)
5. PXE server delivers NBP to client
6. NIC TFTPs boot image (from WDS)
4 This can be couple of different ways. If the DHCP request returned options 66 and 67, then the NIC BIOS will directly use the information in these options to contact the PXE server.
If options 66 & 67 are not specified, then the NIC BIOS will send a broadcast request to find a PXE server.
If the PXE server is not on a local subnet, then something needs to forward the broadcast request to the PXE server: iphelpers (there are other possibilities but this is the primary solution to this).
Once the PXE server is contacted, it sends back the info to the client so the client can directly contact the PXE server.