[CentOS] Iptables masq traffic limiting

>We should be talking live.  Why don't your join the #centos-social on freenode
>so we can chat real time?

Robert,
Just got back from my trip and reading that Tutorial, it went on to state
what I now find to be two distinct opposite thoughts. Its says at
http://iptables-tutorial.frozentux.net/chunkyhtml/c962.html that you shouldn't
filter in the NAT Postrouting chain as some streams of packets only have their
first packet hit the chain and everything else is redirected hence the possibility
exists that some packets can miss the rule.

It seems the Filter Forward chain is the safest place to limit what gets masq'ed
so internal clients could only have say port 80/443 but no ftp access as an example.

What are your thoughts in this?
Thanks,
jlc