Forward Port 25 to internal mail server from specific IP's only

Hi

I am just setting up Untangle in a small environment. I have set a port forward rule to forward port 25 to the internal mail server IP and everything is working fine.

What I need to do now is block all external incoming connections to port 25 apart from 4 allowed IP's. Do I do this within the port forward rules or the firewall rules? I'm assuming its safer to do it at the firewall as this sits in front of the port forward.

For the actual rules I was going to setup a firewall rule for each IP and then block all other inbound traffic for port 25:

Allow x 4

Source interface Is External AND
Destination Interface Is Internal AND
Destination Port Is 25 AND
Source Address Is 1.2.3.4 AND
Protocol Is TCP

Block

Source interface Is External AND
Destination interface Is Internal AND
Destination port Is 25

Does this look correct?

Thanks for your help