iptables rule to block when DNAT is used

[Hanasaki JiJi]

Firewall has rules to DNAT incoming traffic to a port on a DMZ box.
how can an iptable rule be written to block some ip addresses before 
they get to the rules
        iptables -t mangle -A FORWARD
                AND
        iptables -t nat -A PREROUTING
???