It's nice to see that others are using "apsfilter". I've been using it to support printers on OpenBSD systems. At home OpenBSD is my preferred choice for a NAT/DHCP Server/SPI firewall box. Along with the firewall I also find it useful to share our one and only laser printer in the house by using "apsfilter" on the firewall as well.
I know running services on a firewall is bad but with a reasonable set of PF rules in place it's possible to block access to running services from the WAN interface. Lets face it any box that runs as a print server needs to be on all of the time anyways and so does the firewall. No one wants to have to walk into our den and turn on a firewall or print server when they want to access the Internet or print something.