IP filter iRule on subnet virtual

I am looking for an answer if I can create an iRule to filter to allow only specific destination IP (tcp21) on subnet virtual (with port tcp21). This is old production subnet virtual with FTP profile, and we have some policy to move them to specific host FTP virtuals or use filter to allow as mentioned above. The port scan on the subnet FTP virtual responds to FTP on all IP's which is what we want to restrict to the real FTP IP's. so I have 2 options, and need to which one would work better (if they would)

 

 

1> create specific host IP FTP virtuals

 

2> create filter using iRule

 

 

 

Appreciate responses.

 

 

Thanks

 

 

Pravin