iptables whitelist doesn't work while blacklist does

Question

Allowing forwarding for all and blocking a set of ips work:

iptables -P FORWARD ACCEPT
iptables -A FORWARD -m set --match-set denied_ips src,dst -j REJECT

But denying forwarding for all and allowing a set of ips doesn't work:

iptables -P FORWARD DROP
iptables -A FORWARD -m set --match-set allowed_ips src,dst -j ACCEPT

What's up with this?

edit: For clarification here are my rules. I want FORWARD to drop everything not in allowed_ips.

#iptables -S
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-A FORWARD -m set --match-set allowed_ips src,dst -j ACCEPT

Answer 1

I found the answer: It turns out

iptables -A FORWARD -m set --match-set allowed_ips src,dst -j ACCEPT

matches only when both src AND dst in allowed_ips. I mistakenly thought it would match when either src or dst are in allowed_ips.