IPTABLES allow connection to a list of IPs to a specific user (ip) - block all the rest from this user only

We all have that user that needs to access only a certain range of IPs in a network were everyone has access to internet so...

# IP forward
echo "1" > /proc/sys/net/ipv4/ip_forward
# CleanUP
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat

# Lets drop
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP.

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

#  Masking
iptables -A POSTROUTING -t nat -o $IF_EXTERNAL -j MASQUERADE

# ALLOW ONLY ACCESS LIST TO 192.168.10.10 REST OF INTERNET IS BLOCKED
ALLOW_IP_RANGE="8.8.4.0/24 8.8.8.0/24 8.34.208.0/20 8.35.192.0/20 23.236.48.0/20"
iptables -N ALLOWIPRANGE
for IPLIST in $ALLOW_IP_RANGE; do
    iptables -I FORWARD -m tcp -p tcp --destination $IPLIST -j ALLOWEDIPS
done
iptables -I ALLOWEDIPS -s 192.168.10.10 -j ACCEPT
iptables -A FORWARD    -s 192.168.10.10 -j REJECT

# Forward the rest of internet to every one else
iptables -A FORWARD -i @IF_INTERNAL -j ACCEPT

This is not working and I tried to move the:

iptables -A FORWARD -s 192.168.10.10 -j REJECT

from the beginning to the end, but the IP still gets full internet.

Probably this is not a clean solution, but it will work

All users will have access to the internet except restricted user

# Define variables
USER_IP=172.16.0.101
ALLOW_IPS="1.2.3.4 2.3.4.5 3.4.5.6"
IF_EXTERNAL=vmbr0

# Clearing iptables from previous allow ip rules by comment and masquerade
iptables-save | grep -v "userrestricted\|MASQUERADE" | iptables-restore

# Generate rules for masquerading from restricred user(ip)
for ALLOW_IP in $ALLOW_IPS
do
iptables -t nat -A POSTROUTING -s ${USER_IP} -d ${ALLOW_IP} -o ${IF_EXTERNAL} -j MASQUERADE -m comment --comment userrestricted
done

# Trick with SNAT will invalidating target packets
iptables -t nat -A POSTROUTING -s ${USER_IP} -o ${IF_EXTERNAL} -j SNAT --to 127.0.0.1 -m comment --comment userrestricted

# Get common masquerade rule back
iptables -t nat -A POSTROUTING -o ${IF_EXTERNAL} -j MASQUERADE

It works for me, make sure you have common masquerade rule after restricted user rules

Please check it, if it's not what you want i can correct answer