http_access allow localhost
http_access deny all
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_single_host off
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
# This code should appear immediately after any NAT rules
rdr on $int_if inet proto tcp from any to $external_net port 80 -> 127.0.0.1 port 8080
pass in quick on $int_if inet proto tcp from any to 127.0.0.1 port 8080 keep state
pass out quick on $ext_if inet proto tcp from any to any port 80 keep state
iptables -t nat -A PREROUTING -m tcp -p tcp --dport 80 -j REDIRECT --to-port 8080
$IPCHAINS -A input -p TCP -d 127.0.0.1/32 80 -j ACCEPT
$IPCHAINS -A input -p TCP -d $INTERNALIP/32 80 -j ACCEPT
$IPCHAINS -A input -p TCP -s $INTERNALNET -d $REMOTENET 80 -j REDIRECT 8080
Trust is great, as far as it goes, but for my systems, I use a filter anyway just to prevent typo problems and similar accidental stuff. I do this for my own use, not for my daughter: she's barely two years old, she doesn't have any clue yet how to use a computer or why she'd want to :) So, it's not an issue of trust, it's just a matter of prevention.
My recommendation: go ahead and use the filter, and keep trust as an entirely separate discussion.