Restrict NTP to specific subnets

Hi there. I'm installing the NTP server package on a CCR1009 this weekend so I can have some IP phones and other devices use the LAN IP of the CCR to get NTP.

However, I don't want to allow the WAN IP of the CCR to be used as the NTP server.

What's the best way to accomplish this ?

Drop all port 123 on INPUT chain, specifying the interface of the WAN feed. Then allow port 123 on the LAN interface?