openvpn - block users to some networks

hi all,

my external users can access the openvpn server fine using there openvpn clients but i want to block some users to some networks and only allow them access to some IP addresses only

what i have done is create a "client specific overrides" and given them a static ip so when they login from home using there common name they get assigned a specific ip and this works

next i have gone to "firewall rules openvpn" and under that tab i have created rules (see attached pic)

https://s31.postimg.org/w5gizmf7f/openvpn_rules.png

but they dont work, they can gain access to not only the ceta servers but gain access to other networks/servers

im sure im doing something really stupid

cheers,
rob