Firewalling with a web server and users through the same network port

I would like to use a single internet connection for web users and to run a web server. I know how to set up masquerading, and I know how to direct http ports to a webserver, but how can I do both? Somehow I need an unassociated web message (which would normally be rejected by masq) to be sent to the webserver. I other words an external user sees the webserver and internal users browse the web oblivious to that external user.
I get a bad feeling regarding security, but would any solution be any worse than just running a webserver?

Regards

Paul