"Gateway" was the key. Silly of me to forget…
I changed the two hosts' default gateway from the Linksys to the pfSense - for the WinXP I added the Linksys as a second gateway, for the Brother there isn't room. Both hosts were apparently receiving pings/print requests/whatever, but didn't know how to reach the sender with a response.
And yes, I added rules up the wazoo: my network can talk to those two addresses but nothing else on their network, and only those two hosts can talk to my network.
It could be defeated by unplugging either host from their network and replacing it with a rogue machine with the same address; for the moment, however, I'm satisfied.