after some research it looks like setting to unreachable better than deny