Trying to setup a vpn killswitch but not having any luck

[Rick7C2]

Right now I have my vpn setup so only 192.168.1.200-192.168.1.249 use vpn.

In addition to that rule the vpn is bypassed if the destination ip is in my ipset.

I'm trying to setup a killswitch that blocks internet access for only the ip's above and only if the destination ip doesn't match my ipset.

I've tried...

# Reject all non white listed connections from vpned ip's from outgoing wan interface.
iptables -I FORWARD -i br0 -m iprange --src-range 192.168.1.200-192.168.1.249 ! -m set --set bypass_vpn dst -o $(nvram get wan_iface) -j REJECT --reject-with icmp-host-prohibited

But I can't get the ! to work.


I've also tried

# Allow whitlisted connections from vpned ip's from outgoing wan interface
iptables -I FORWARD -i br0 -m iprange --src-range 192.168.1.200-192.168.1.249 -m set --set bypass_vpn dst -o $(nvram get wan_iface) -j ALLOW

# Reject all connections from vpned ip's from outgoing wan interface.
iptables -I FORWARD -i br0 -m iprange --src-range 192.168.1.200-192.168.1.249 -o $(nvram get wan_iface) -j REJECT --reject-with icmp-host-prohibited

But this doesn't stop the internet access when vpn is off.

What am I doing wrong?