It's less surprising and the obvious way to do it. Iptables are very powerful, but not needed in this case.