Per my conversation with product security people, we do not need to restrict the destination port (`--dport`) if we are restricting the source hosts (`-s`) to Rackspace internal.