Restrict NAT access to private network

[BelCloud]

I am trying to restrict NAT guests from accessing the private network (running a NFS)

I have tried to block it via iptables, but no luck:
iptables -A FORWARD -i guest -d 10.0.0.0/8 -j DROP


Any suggestions?

Thank you