I wouldn't punch it on the server when you have a router/firewall that is designed to do that.. I would never forward to a server directly on normal lan where all your other boxes are, like I said I would put the server that is serving up stuff to the public in its own isolated segment from the rest of my network..
So even if its compromised it would only have access to your other stuff in this isolated segment.
"pfSense does nothing to help, the security needs to be server-side anyways"
How is that?? When you can use the firewall on pfsense to only punch the whole to this server on the actual service ports and don't have to worry about something else listening that you didn't firewall at the host firewall, like say samba, or ssh or whatever.. If say your serving up ntp, that is the only thing allowed from inet to this box. While it might also be running ssh or http, etc..
