Blocking netbios to the internet with iptables

I'm considering the following rule:
## Drop Netbios traffic to the internet (eth1)
## Just ignore that 137 and 138 are udp and 139 is tcp.
iptables -t mangle -A POSTROUTING -p ALL -d 0/0 --dport 137:139 -o
eth1 -j DROP

It seems benefical to have just 1 rule as opposed to one for the OUTPUT
chain (because of Samba)
and one for FORWARD (because of Windows machines).

Is this save to do? Any caveats?

Thanks,
John